More than 300 UK businesses reported ransomware attacks. The real number is probably much higher.
If you run a small business, school or charity, it’s easy to think ransomware is something that only happens to household names.
Marks & Spencer.
Co-op.
Jaguar Land Rover.
Those attacks make the headlines. Thousands of smaller organisations never do.
According to new figures published by Infosecurity Magazine, using data from Report Fraud and the City of London Police, 323 UK organisations reported successful ransomware attacks between April 2025 and March 2026. More than half of those reports came from small and medium-sized businesses.
That’s roughly 26 successful ransomware attacks every month.
And those are only the organisations that came forward.
Why the numbers are probably much higher
One of the biggest challenges with ransomware is under-reporting.
Some organisations worry about reputational damage.
Some never realise exactly what happened.
Others simply recover quietly and move on.
The City of London Police also noted that financial losses are likely to be significantly underestimated because many victims don’t disclose the full cost.
When you include:
- downtime
- lost productivity
- IT recovery
- legal advice
- forensic investigations
- customer communications
- lost sales
…the true impact is often far greater than the ransom itself.
Small businesses are firmly in the firing line
One statistic stood out. Over 50% of reported victims were SMEs.
That completely destroys one of the biggest cyber security myths we still hear.
“We’re too small for hackers.”
Modern ransomware groups don’t usually pick victims one at a time.
They scan the internet looking for vulnerable systems, weak passwords, exposed remote access and stolen credentials.
If they find an easy way in, your size doesn’t matter.
Manufacturing, education and professional organisations featured heavily
Among organisations that identified their sector:
- Manufacturing reported the highest number of attacks.
- Scientific and technical businesses were next.
- Education also featured prominently.
That mirrors what we see across Derbyshire and South Yorkshire.
Criminals increasingly target organisations that can’t afford prolonged downtime.
If your production line stops…
If your school can’t access systems…
If your business loses customer files…
The pressure to recover quickly becomes enormous.
The good news? Ransomware is becoming far more survivable
The encouraging part of this report wasn’t actually the statistics. It was the advice.
The recommendations from Report Fraud closely match what the National Cyber Security Centre (NCSC) has been saying for years:
- Keep systems updated.
- Use strong access controls.
- Enable multi-factor authentication.
- Take regular backups.
- Test those backups.
- Prepare before an incident happens.
Resilience is built through layers of sensible controls working together.
Backups aren’t enough if you’ve never tested them
Many organisations proudly tell us:
“We’ve got backups.”
That’s a great start. The next question is usually more important.
Have you actually restored anything from them recently?
We’ve seen organisations discover during an incident that:
- backups had been failing for months
- encrypted files had already been backed up
- recovery took far longer than expected
- critical systems weren’t included
A backup you can’t restore isn’t really a backup.
Prevention is still far cheaper than recovery
The report also highlights why paying the ransom rarely solves the problem.
Even if criminals provide a decryption key:
- it may not work
- some data may never return
- rebuilding systems can still take weeks
- attackers may strike again later
Recovery is rarely as simple as paying and carrying on.
What should your organisation do today?
If you’re wondering where to begin, focus on the basics.
- Turn on multi-factor authentication.
- Patch vulnerable systems quickly.
- Make sure endpoint protection is working.
- Back up your Microsoft 365 data and servers.
- Test your restores.
- Train your staff to spot phishing emails.
- Have a plan for what happens if the worst occurs.
These aren’t glamorous, but they’re the controls that make the biggest difference.
Don’t wait until you’re the next statistic
Ransomware isn’t going away.
But becoming a victim isn’t inevitable.
The organisations that recover fastest are usually the ones that prepared before the attack happened.
If you’re unsure where your biggest risks are, we can help you assess your current protections and identify practical improvements without the jargon or scare tactics.
Book a free cyber security consultation with Black Swan Cyber and let’s make sure your business is ready before criminals come knocking.
Source
This article is based on reporting by Phil Muncaster in Infosecurity Magazine, using figures released by Report Fraud and the City of London Police. It has been rewritten and expanded with additional practical guidance and commentary. No original text has been reproduced. Original reporting: Over 300 UK Firms Hit by Ransomware in a Year (30 June 2026).
