UK ransomware figures: 323 firms reported attacks in a year

New UK ransomware figures from the City of London Police show 323 organisations reported a ransomware attack to Report Fraud between April 2025 and March 2026. More than half were small and medium-sized businesses. The police published the figures on 29 June 2026 with a simple message: don't pay, report it, and prepare before it happens.

What the UK ransomware figures show

Ransomware is when criminals get into your systems, lock or steal your files, and demand payment to give them back. These are the figures from Report Fraud, the national police service for reporting fraud and cyber crime.

The police say these figures understate the problem. They only count what victims chose to report, and officials told CIR Magazine the true scale is "significantly higher". Many firms don't report at all, or leave out what it cost them, because they worry about their reputation. So treat these numbers as the minimum, not the full picture.

What it means for you

If you run a 10 to 30 person business in Norfolk, the main point is that this isn't only a big-company problem. More than half the reports came from firms like yours. Attackers rarely pick a target by name. They look for easy ways in: a reused password, a laptop that's months behind on updates, a remote access login without a second check.

The other point is that the cost of an attack isn't mainly the ransom. It's days without your files, your email or your accounts system, and the time it takes to rebuild. A business that can restore from a clean backup is back working far sooner than one that can't.

You're in a good position if you already have multi-factor authentication (MFA, a code on your phone as well as a password) on email and remote access, updates install automatically, and you have a backup that's kept separate from your network and has been tested. If you're not sure about any of those, that's where to start.

What to do now

1. Check your backups are separate. The NCSC says to always have a recent offline backup of your most important data. A USB drive left plugged in, or a copy on the same server, can be locked along with everything else.
2. Test a restore. Pick a folder and bring it back. If nobody has ever done this, you don't yet know the backup works.
3. Turn on MFA for email, Microsoft 365 and any remote access, for every user.
4. Keep everything updated. Cyber Essentials expects critical and high-risk updates to be installed within 14 days. Our PHP2Shell article shows how fast attackers now move after a fix is announced.
5. Work towards Cyber Essentials. It covers the basic controls that stop most common attacks. The NCSC's free Cyber Action Toolkit, built for sole traders and small businesses, is a good first step.
6. Know who to call. If you're hit, report it to Report Fraud on 0300 123 2040, 24 hours a day, and call your IT support. Write both numbers down somewhere that isn't on your computer.

How we can help

Our backup and disaster recovery service is from £25 +VAT a month, with off-site copies and test restores so you know it works. Our cyber security team sets up MFA and managed antivirus (from £5 +VAT per user a month), and as an IASME certification body we can take you through Cyber Essentials from £900 +VAT in year one. Get in touch and we'll tell you plainly where you stand.