According to CrowdStrike’s latest European Threat Landscape Report, Europe accounts for nearly 22% of organisations named on ransomware leak sites, making it the second most targeted region globally. More importantly for UK schools and small businesses, the methods cyber criminals use are becoming more accessible and increasingly focused on organisations of all sizes.
The good news? Most successful attacks exploit basic security gaps rather than sophisticated vulnerabilities. This means that practical, achievable steps can significantly improve your security posture.
Why small and medium organisations matter to cyber criminals
You might wonder whether your school or business is really on anyone’s radar. The reality is that all organisations now face some level of cyber risk, regardless of size:
1. Data has value
Whether it’s student records, financial information, customer data, or business intelligence, your data matters. Under GDPR, data breaches carry regulatory implications, which can add pressure during an incident.
2. Resource constraints are well-known
Attackers understand that smaller organisations typically have limited IT resources. This doesn’t make you more valuable as a target, but it does mean you need to be strategic about where you invest your security efforts.
3. The evolving cyber crime marketplace
An underground marketplace now exists where criminals can purchase tools and services to launch attacks. CrowdStrike researchers identified over 1,400 European entities whose network access was being advertised on these forums over the past two years. This “professionalisation” of cyber crime means you need to stay informed about current methods.
Three current threat trends worth understanding
Trend 1: Voice-based social engineering (Vishing)
Telephone-based attacks, known as “vishing,” are increasing across Europe. CrowdStrike observed nearly 1,000 vishing-related incidents during the reporting period, with attackers increasingly using native speakers to target specific countries.
These calls often impersonate IT support, suppliers, or officials and aim to obtain credentials or convince staff to take actions that compromise security.
Why this matters: Phone calls bypass many technical defences, making staff awareness your primary protection. The calls can be convincing and well-researched.
Trend 2: Fake CAPTCHA prompts
A newer technique involves fake “verify you’re human” prompts that trick users into executing malicious code. CrowdStrike identified over 1,000 incidents involving these fake CAPTCHAs targeting European organisations in 2024-2025.
These attacks work because the prompts look like legitimate security checks. Victims believe they’re solving a routine security challenge when they’re actually compromising their own systems.
Why this matters: Ready-made tools for creating these fake prompts are now available on cybercrime forums, meaning more attackers can use this method. Cyber security awareness training is key to prevention.
Trend 3: Targeted data extortion
Since January 2024, approximately 2,100 European organisations have been named on ransomware leak sites. The UK, Germany, Italy, France and Spain see the highest volumes. The most frequently targeted sectors include manufacturing, professional services, technology, industrials, and retail, though education, healthcare and financial services are also regularly affected.
Modern attacks often involve both encryption and data theft, with attackers threatening to publish stolen information if demands aren’t met.
Why this matters: Understanding that you’re operating in an environment where these incidents occur regularly helps contextualise your security investments and planning.
Real-world impact: Beyond the headlines
A successful cyber attack creates several challenges:
- Operational disruption: Temporary loss of access to critical systems and data
- Response costs: Investigation, remediation and system recovery require time and resources
- Regulatory considerations: Depending on the nature of the breach, GDPR reporting requirements may apply
- Reputation management: Communicating transparently with stakeholders during and after an incident
- Business continuity: Maintaining operations during recovery
The financial impact varies considerably depending on organisation size, incident severity and response capability, but having a plan in place significantly reduces both costs and recovery time.
Practical defences for your organisation
You don’t need an enterprise-scale budget to meaningfully improve your security. Here are six practical steps:
1. Build security awareness
Since technical defences can’t stop sophisticated social engineering, your team needs to recognise common attack patterns.
Practical steps:
- Run regular security awareness training covering current threats
- Establish a verification protocol: if someone requests credentials, access, or urgent action by phone, staff should independently verify their identity using a known contact method
- Create a culture where reporting suspicious contacts is encouraged and easy
- Include security basics in new employee onboarding
2. Strengthen authentication
Compromised credentials remain a common entry point for attackers.
Practical steps:
- Enable multi-factor authentication (MFA) for all critical systems, particularly email, financial systems and administrative access
- Review and disable inactive accounts regularly
- Consider phishing-resistant MFA (such as hardware security keys) for high-risk accounts
- Implement time-limited access for administrative functions
3. Maintain reliable backups
Backups are your primary recovery mechanism if systems become encrypted or compromised.
Practical steps:
- Follow the 3-2-1 principle: three copies of data, on two different media types, with one stored offline or offsite
- Test your restoration process regularly – don’t discover problems during an emergency
- Keep at least one backup that ransomware can’t access (offline or immutable)
- Document your backup and recovery procedures clearly
4. Keep systems current
Attackers regularly exploit known vulnerabilities in widely-used software.
Practical steps:
- Enable automatic updates where feasible
- Maintain an inventory of your software and systems
- Prioritise patching for internet-facing systems (web servers, email, VPNs)
- Have a process for deploying urgent security updates quickly
5. Secure remote access
With remote and hybrid working now standard, securing remote access is essential.
Practical steps:
- Use VPNs with strong authentication for remote access
- Review remote access permissions regularly and remove unnecessary access
- Monitor for unusual login patterns (unexpected times, locations)
- Consider network segmentation to limit what remote users can access
6. Prepare an incident response plan
Having a documented plan significantly reduces response time and confusion during an incident.
Practical steps:
- Document key contacts: IT support, legal counsel, insurance provider, relevant authorities
- Identify critical systems and data that would need priority recovery
- Establish a communication plan for staff, customers, and stakeholders
- Consider cyber insurance as part of your risk management approach
- Test your plan with tabletop exercises
- Print out your plan and save it in a secure location
Resources and support
Many organisations find these measures more manageable than expected, and support is available:
- Managed Security Service Providers (MSSPs) can provide monitoring and expertise at various price points
- The National Cyber Security Centre (NCSC) offers free guidance specifically for small organisations and schools
- Industry associations often provide sector-specific cyber security resources
- Cyber Essentials certification provides a practical framework for basic security controls
- Cyber insurance providers typically include risk assessment support
Taking a proportionate approach
The cyber security threats in 2025 require awareness and preparation, but they don’t require panic. Most successful attacks exploit basic security gaps that can be addressed through practical measures.
The key is to:
- Stay informed about current threats
- Implement fundamental security controls
- Build a security-aware culture
- Have a recovery plan in place
By taking these steps, you move from being an easy target to a prepared organisation that can respond effectively if an incident occurs.
The best time to improve your security posture is before you need it. Start with one or two of the measures above and build from there.
About this report
This article is based on findings from the CrowdStrike 2025 European Threat Landscape Report, which analysed cyber threat activity targeting Europe from January 2024 to September 2025.
