5 October 2026
14:24
The government’s Cyber Security Breaches Survey, published each spring, tells you how many UK businesses had a cyber attack or breach in the last year (43%, in the 2025/26 edition) and which kinds were most common. It doesn’t tell you what one looks like on the day it reaches a business of your size. Here are five incidents that crossed our desk in 2026, with every name and identifying detail removed. For each one: what happened, what the survey or the NCSC's Annual Review says about how common it is, and what it took to catch it.
A buyer who wasn’t the buyer. An enquiry arrived through our website from a large, well-known company asking to buy equipment on account. The company was real. The person was not; someone was using a genuine employee’s name and the firm’s credit history to get goods shipped without paying for them. In the survey, 12% of UK businesses said outsiders had impersonated them or their staff in the last year, and the cost usually lands on the supplier who ships the goods, not on the company whose name was borrowed. It was caught before anything left the warehouse, because someone checked the order against the company rather than the company’s reputation. We have since changed how every inbound enquiry is verified before an account is opened.
A mailbox that kept working. One mailbox compromise we handled this year started with valid credentials, which is what phishing is for. The survey records phishing at 38% of businesses, the most common attack type by a distance. The attacker did nothing obvious. An inbox rule forwarded and hid messages while they waited for something worth acting on. It came to light when a recipient queried an email they hadn’t expected, and it was closed within minutes: the rule removed, every session and password reset. Without that query it would have run for weeks.
A website with pages missing. Another was a company website. Pages had been deleted, and the cause was traced to one piece of the site’s software that hadn’t been updated. Of the five incidents this is the most ordinary and the one with the clearest national evidence: in the year to August 2025 the NCSC traced 29 of the incidents it managed to three known software flaws for which fixes already existed. The site was taken offline, restored from a clean backup and rebuilt with the gap closed, and the whole thing was over in a day. The site had an owner for its content and nobody for its upkeep.
A backup service that became a way in. This year a widely used Microsoft 365 backup platform disclosed that attackers had used a stolen password belonging to the backup software itself, rather than to any person, to sign in to its customers’ Microsoft 365 accounts. Because no person logged in, multi-factor authentication (MFA) never came into it. The backup software already had permission to read mail and files, and in some customer accounts the attacker used that permission to make itself an administrator. The survey says 15% of businesses have reviewed the cyber risk of their immediate suppliers; the number who have reviewed which third-party apps hold permissions on their Microsoft 365 account is smaller still. We spent time this autumn contacting clients who might have connected it at some point, including ones whose backups we don’t manage.
A ransomware incident with nobody to ring. A mid-sized UK business was hit by what we believe to be ransomware. Ransomware is now rare in the survey, at 1% of businesses, which is partly why so few are ready for it: only a quarter have a formal incident response plan. This business had no arrangement with an incident response firm and no service watching its systems for intrusions, so the first day went on finding someone to call rather than on containing anything. Our first job was to find them a specialist incident response partner.
None of them used a technique anyone in security would call new. Three started with a password or a permission that somebody had already granted: a login, an inbox, a backup app’s standing access. One started with software nobody had updated. One started with a web form. That matches the survey, where phishing and impersonation make up most of what businesses report, and ransomware affects just 1%.
The outcome in each case was decided by two things. Whether someone noticed quickly: a recipient who asked about an unexpected email, a person who checked a purchase order. And whether there was something to fall back on: a clean backup, a partner who could respond on the day. The business that came off worst had neither, and spent its first day finding help. Our Reduce risk work with clients spends more time on those two things than on any product, and most of the business resilience side of it is rehearsal.
Four things, none of which needs a project. List the third-party apps that hold permissions on your Microsoft 365 account and remove any you no longer use; a backup or migration tool you stopped using years ago may still be able to read your mail. Ask how a credit account gets opened in your company’s name, and who confirms the person is who they say they are. Run a restore from backup, rather than reading the report that says the backup succeeded. And write down who you would ring if your systems were encrypted tomorrow, with a number that is answered at night.
If you want an external benchmark, Cyber Essentials v3.3, in force since 27 April 2026, requires MFA on every cloud service and critical or high-risk updates applied within 14 days of release. The website incident above is the kind the 14-day rule exists to prevent.
It is easy to quote the 43%, but harder to answer the four questions above about your own business. The answers are worth more than the figure, and they argue better at budget time. Our Cyber Security Awareness Month guide sets out what to do about them, in order.
If you would rather have help, our cybersecurity services page sets out how we approach it; talk to us and we’ll set out where we’d begin.
