UK ransomware:what the latest numbers say
Published
Ransomware attacks on UK organisations are rising fast, and the NCSC is handling four nationally significant incidents a week. The figures, and the question every board should be asking.
In the year to the end of August 2025, the NCSC supported 429 incidents. 204 of them were nationally significant, up from 89 the year before, and 18 were highly significant: a rise of almost 50%, and the third year running. The NCSC points out that many breaches are never reported, so the real numbers are higher.
More recent figures point the same way. Data from Cohesity, reported by IT Pro on 12 October 2026, shows UK ransomware attacks up 60% on the previous quarter and 42% on a year ago. Two groups, Qilin and The Gentlemen, were behind nearly a third of them.
The question to ask
Launching its review, the NCSC put one question to every leader: “What is your plan? How will you continue when your IT is gone?” It adds that the plan has to be written by the organisation itself.
What to do
- Backups you can restore: keep at least one copy offline or immutable, and test a full restore, not just a single file.
- Multi-factor authentication on email, remote access and every admin account.
- Patch internet-facing systems first: VPNs, firewalls, remote access and web servers are the doors attackers try.
- Know what happens on the day: who decides, who you call and how you keep trading. Write it down and rehearse it. Our Incident Response service can help you prepare.
- Get the basics certified: Cyber Essentials covers the controls that stop many common attacks.