Key Takeaways
- Most attacks cost little, but serious ones cost thousands.
- Reported figures usually leave out downtime and lost customers.
- Supply chain attacks can hit you even when you’re not the target.
- Prevention is cheaper and more predictable than recovery.
- Estimate your own downtime cost to understand your real risk.
Want to cut your risk? Explore Digit IT’s cyber security services. You can also read our guides on cyber security essentials and common SME security mistakes.
Most UK small businesses report low direct costs from cyber attacks. For firms that do lose money, the average bill runs into thousands of pounds. The worst cases cost far more. Hidden costs make the real figure higher still. These include downtime, lost customers, staff time and possible fines. The true cost is rarely the invoice alone.
What Does the Latest UK Data Say?
The government’s 2025/2026 survey gives the clearest picture for UK firms.
Here’s what it found:
- The typical business reported no direct cost at all. The median perceived cost of the most disruptive breach was £0.
- Among businesses that did lose money, the average rose to £3,550 per disruptive breach.
- For the worst 5% of cases, costs reached £4,000 for micro and small businesses and £10,000 for medium and large firms.
- Firms reporting lost revenue rose from 2% to 5% in a single year.
So most attacks cause little damage. But when one gets through, it hurts.
Why Are the Headline Figures Misleading?
The survey figures are self-reported direct costs. Business owners estimate them after the event.
They often leave out:
- Hours your team spends fixing problems
- Sales lost while systems are down
- Customers who quietly go elsewhere
- Higher insurance premiums at renewal
That’s why the real cost is usually much bigger than the reported one.
What Are the Hidden Costs of a Cyber Attack?
| Cost type | What it looks like |
| Downtime | Staff can’t work, orders stop |
| Recovery | Emergency IT support, new hardware |
| Fraud losses | Payments sent to fake bank details |
| Reputation | Lost trust, fewer referrals |
| Regulatory | ICO investigation, possible fines |
| Insurance | Higher premiums or refused claims |
Regulatory risk explained: If personal data is exposed, UK GDPR may apply. Serious breaches must be reported to the ICO within 72 hours.
Can One Attack Affect Your Whole Supply Chain?
Yes, and 2025 proved it. The Jaguar Land Rover attack halted production for around five weeks. It was modelled at a £1.9 billion economic impact. Disruption spread to more than 5,000 supply-chain organisations.
Many of those suppliers were small firms. They lost orders through no fault of their own.
Is Prevention Cheaper Than Recovery?
Almost always. Here’s a simple comparison for a 10-person business.
| Prevention | Recovery | |
| Timing | Planned and budgeted | Sudden and urgent |
| Cost | Predictable monthly fee | Unknown, often thousands |
| Downtime | Minimal | Days or weeks |
| Stress | Low | Very high |
Basic controls like MFA, backups and training are low-cost. Cyber Essentials certification starts at a few hundred pounds.
How Can You Estimate Your Own Risk?
Follow these steps to work out a rough figure.
- Work out your daily revenue. Divide annual turnover by working days.
- Estimate downtime. Assume three to five days for a serious incident.
- Add staff costs. Multiply daily wages by lost working days.
- Add recovery costs. Include emergency IT support and replacement kit.
- Add a reputation buffer. Estimate lost repeat business over six months.
Example: A firm turning over £750,000 earns about £3,000 per working day. Five days of downtime means £15,000 in lost revenue. That’s before recovery costs.
A Real-World Example
A Hemel Hempstead design agency lost access to its files after a phishing attack. It had backups, but nobody had tested them. Restoring everything took four working days. The agency missed two client deadlines and lost one retainer. The attack’s “direct cost” looked small. The real cost ran into thousands.
Frequently Asked Questions
1. What is the average cost of a cyber attack for a UK small business?
For businesses that lost money, the average was around £3,550. The worst cases cost much more.
2. Does cyber insurance cover all attack costs?
Not always. Claims can be refused if basic security controls weren’t in place.
3. Can a small business be fined after a data breach?
Yes. The ICO can take action if personal data wasn’t properly protected.
4. What costs the most after a cyber attack?
Usually downtime. Lost sales and staff time often exceed direct recovery costs.
5. How quickly must a data breach be reported?
Serious personal data breaches must be reported to the ICO within 72 hours.
6. How much should a small business spend on cyber security?
It depends on your size and risk. A security review helps set a sensible budget.
