UK Cybercrime in 2026: The Numbers Behind the Threat

Updated: 17 October 2026

Nearly 800,000 computer-misuse incidents were estimated in England and Wales in a single year. Meanwhile, reported losses from email and social media account hacking rose sharply, and almost one in five businesses was estimated to have experienced cybercrime.

But these numbers do not all measure the same thing. Some estimate incidents people experienced, some measure the share of organisations affected, and others count reports submitted to a reporting service. Understanding that difference is essential to seeing what the figures really tell us about cybercrime in 2026.

Here is what the latest available evidence shows, what we calculated from it, and where the numbers leave important questions unanswered.

UNDERSTANDING THE DATA

Three measures, three different questions

These figures describe different aspects of cybercrime. They use different populations and methods, so they should not be added together or treated as directly comparable.

01 / SURVEY ESTIMATE

Office for National Statistics

798,000

computer-misuse incidents

What does it measure?

Estimated incidents in England and Wales in the year ending March 2026. This is an incident estimate, not a count of reports submitted to police.

View ONS source ↗

02 / ORGANISATION SURVEY

UK Government survey

19%

of businesses

What does it measure?

The estimated share of businesses that experienced cybercrime in the preceding 12 months. It describes organisations, not individual people.

View government survey ↗

03 / REPORTED DATA

Report Fraud dashboard

61,777

cybercrime reports

What does it measure?

Reports shown in the dashboard snapshot discussed in this article. The count depends on the selected filters and reporting period.

View dashboard ↗

Why this distinction matters: an estimated incident, an organisation experiencing cybercrime and a report submitted to a reporting service are not the same unit of measurement. Interpret each figure using its own source, population and reporting period.

How much cybercrime is being recorded?

The Office for National Statistics (ONS) estimated 798,000 computer-misuse incidents in England and Wales in the year ending March 2026. It found no statistically significant change compared with the previous year.

This is a survey estimate of incidents, not a count of reports submitted to the police. It covers England and Wales, so it should not be described as a complete count of all cybercrime across the UK.

The ONS has also temporarily stopped presenting police-recorded fraud and cybercrime figures in its bulletin while the transition to the new Report Fraud system is being addressed. That limits the availability of a directly comparable police-recorded series, but it does not remove the ONS survey estimate.

Source: Office for National Statistics, Crime in England and Wales: year ending March 2026.

What proportion of organisations experience cybercrime?

The UK government’s Cyber Security Breaches Survey 2025/26 estimated that 19% of businesses and 14% of charities experienced at least one cybercrime in the preceding 12 months. The government estimated that this represented approximately 267,000 businesses and 28,000 registered charities.

The business figures have moved from 22% in 2023/24 to 20% in 2024/25 and 19% in 2025/26. The charity estimate remained at 14% in all three years.

Our calculation shows a three-percentage-point decrease in the business estimate between 2023/24 and 2025/26. That is not the same as a three per cent relative decrease, and the figures alone do not establish that every year-to-year change is statistically significant.

Business size also appears to matter. The survey estimated that cybercrime affected 17% of micro businesses, 24% of small businesses, 41% of medium businesses and 48% of large businesses. Differences in exposure, security monitoring and the ability to detect incidents may all contribute to this pattern.

These percentages apply to organisations, not individual members of the public. They also depend on respondents recognising and recalling incidents, which means some activity may not be captured.

Source: UK Government, Cyber Security Breaches Survey 2025/26.

Phishing stands out among affected organisations

The government’s survey found that 93% of businesses and charities that experienced cybercrime reported phishing-related cybercrime. This percentage applies only to organisations that had already experienced cybercrime. It does not mean 93% of all businesses and charities experienced phishing-related crime.

Among organisations that experienced cybercrime, hacking was reported by 8% of affected businesses and 4% of affected charities. Ransomware was reported by 3% of affected businesses and 5% of affected charities.

These categories can overlap. An organisation may experience more than one type of cybercrime, so the percentages should not be added together to estimate a total.

The figures also need to be read using the survey’s definitions. Not every cyber security breach or attack necessarily qualifies as a crime.

Source: UK Government, Cyber Security Breaches Survey 2025/26.

Account hacking: reported losses rose sharply

Report Fraud reported that losses from email and social media account hacking reached £6.3 million in the 2025/26 financial year, compared with £1.2 million in 2024/25. It reported a 417% increase in losses and a 34% increase in the number of reports.

This is a significant change in the figures reported to the service. It is not, however, a complete count of every hacked account or every financial loss across the country.

A separate snapshot from the City of London Police’s Report Fraud Analysis Services dashboard displayed 61,777 cybercrime reports and £24.4 million in reported losses. Social media and email hacking was the largest displayed category, at approximately 45,600 reports.

Using those displayed figures, we calculate that social media and email hacking represented about 73.8% of the cybercrime reports in that dashboard snapshot. This is an approximate share of the reports shown, not a claim that 73.8% of all cybercrime committed in the UK involves account hacking. The category count is rounded in the chart.

The dashboard also warns that victim selections and reported losses have not been fully verified, and that extreme loss outliers have been removed. Its reporting system changed from December 2025, when CIFAS referrals began to be included. That change can affect the number of reports recorded, so changes across that point should not automatically be treated as changes in the underlying crime rate.

Sources: Report Fraud, email and social media account hacking; Report Fraud Analysis Services dashboard.

Payment diversion fraud: more than £101 million in reported losses

Payment diversion fraud involves criminals persuading a person or organisation to send money to an account controlled by the offender. This can involve impersonating a supplier or sending messages that appear to contain legitimate but altered payment details.

Report Fraud recorded 3,657 payment diversion fraud reports in 2025/26, a 3% increase on the previous financial year. Reported losses exceeded £101 million.

We can estimate a lower-bound average by dividing £101 million by 3,657 reports. That gives approximately £27,618 per report. Because the published losses exceeded £101 million, the resulting average would also exceed that amount if the loss and report totals cover the same category and period.

This is an arithmetic average, not the typical amount lost by a victim. It does not mean each report involved a financial loss, and a small number of high-value cases can strongly affect an average.

Source: Report Fraud, payment diversion fraud.

What do our calculations tell us?

The published figures allow us to calculate useful measures, provided we keep their definitions, reporting periods and limitations clear.

• Business cybercrime prevalence: The estimate fell from 22% in 2023/24 to 19% in 2025/26. The calculation is 22% − 19% = 3 percentage points. This difference between estimates does not, by itself, establish a statistically significant change.
• Share of dashboard reports involving social media and email hacking: Approximately 45,600 of the 61,777 displayed cybercrime reports concerned this category. The calculation is 45,600 ÷ 61,777 × 100 = about 73.8%. Because the category count is rounded, the result is approximate and applies only to the dashboard snapshot and compatible reporting scope described above.
• Dashboard reported losses per report: Dividing £24.4 million by 61,777 reports gives approximately £395 per report. This is an arithmetic average based on rounded dashboard figures, not an estimate of the typical victim’s loss. The dashboard also warns that reported losses have not been fully verified.
• Payment diversion fraud: Reported losses exceeded £101 million across 3,657 reports. Dividing £101 million by 3,657 gives approximately £27,618. This indicates a lower-bound arithmetic average of more than £27,618 per report, provided the loss and report totals cover the same reporting period and category. It does not mean every report involved a loss of that amount.
• Account-hacking losses: Report Fraud published a 417% increase in reported losses, from £1.2 million in 2024/25 to £6.3 million in 2025/26. We retain the published percentage rather than replacing it with a calculation based on rounded amounts.

These are Secritic’s calculations from published figures, not new official statistics. Rounded inputs produce approximate results, and report counts do not necessarily represent unique victims or every crime committed. Differences in reported figures do not, on their own, explain why a change occurred or establish the underlying level of crime.

The calculations help describe reported patterns and financial impact, but they cannot establish how many crimes went unreported, how many unique people were affected, or how likely a particular person is to become a victim.

Can we calculate the probability of becoming a cybercrime victim?

Not reliably from these figures alone.

The 19% business figure and 14% charity figure are estimates for organisations, not individuals. The ONS figure is an estimate of computer-misuse incidents, not a count of unique victims. Report Fraud figures count recorded reports, which may not map one-to-one to victims or all crimes committed.

For those reasons, we cannot responsibly turn these sources into a claim such as “X out of every 100 people in the UK will experience cybercrime in 2026”. Doing so would require a consistent definition, a matching population denominator and a reliable estimate of unique victims over the same period.

The best-supported conclusion is narrower but still useful: cybercrime affects a measurable share of organisations, computer-misuse incidents remain substantial, and specific forms of reported crime can cause significant financial losses.

How we evaluated the evidence

For this article, we separated figures published by official sources from calculations made using those figures. We preserved the original population and reporting period, labelled rounded figures as approximate, and avoided treating reports as a complete count of all crime.

We also considered the limits stated by the sources themselves. The Report Fraud dashboard says that victim selections and reported losses have not been fully verified, extreme loss outliers are removed, and the reporting process changed from December 2025. Those caveats matter when comparing figures across time.

The data provide evidence of reported incidents, survey-estimated prevalence and reported financial losses. They do not provide a perfect measure of all cybercrime or a reliable personal probability of victimisation. We have therefore not presented estimates beyond what the sources can support.

This analysis uses the latest cited releases and dashboard figures available for the stated periods as of 17 October 2026. The figures may change when their publishers update the data.

Sources and further reading

• Office for National Statistics: Crime in England and Wales, year ending March 2026
• UK Government: Cyber Security Breaches Survey 2025/26
• Report Fraud: Email and social media account hacking
• Report Fraud: Payment diversion fraud
• City of London Police: Report Fraud Analysis Services dashboard