• UK cyber attacks surge to 204 nationally-significant incidents in 12 months, up 129%.
• Highly significant incidents up nearly 50%, with nation-state actors and sophisticated criminal groups behind the majority.

The scale of cyber attacks in the UK has reached an alarming threshold, with the country now experiencing four nationally-significant incidents every week. According to the National Cyber Security Centre’s latest annual review [PDF], the threats facing British organisations have escalated, prompting calls for businesses to treat cybersecurity as a matter of survival, not compliance.

GCHQ’s National Cyber Security Centre handled 204 nationally-significant UK cyber attacks in the 12 months ending August 2025 – up from 89 incidents the previous year. That represents a 129% increase and is a shift in the volume and sophistication of threats targeting the nation’s digital infrastructure.

Also concerning is the rise in severity. The NCSC categorised 18 incidents as ‘highly significant’ – those with the potential to cause serious impacts on essential services. That’s a 50% increase compared to the previous year and represents the third consecutive annual rise in these most serious events.

Of the total 429 incidents handled, over half were deemed nationally-significant, meaning they posed substantial threats to the UK’s national security, economy, or important infrastructure. “Cybersecurity is now a matter of business survival and national resilience,” said Dr Richard Horne, Chief Executive of the NCSC. With over half the incidents handled by the NCSC deemed to be nationally significant, and a 50% rise in highly significant attacks on last year, our collective exposure to serious impacts is growing at an alarming pace.”

The actors behind the attacks

A substantial proportion of the incidents recorded by the NCSC were linked to Advanced Persistent Threat actors – either nation-state actors or highly capable criminal groups.

The distinction between ‘nationally significant’ and ‘highly significant’ incidents is important. Nationally-significant incidents substantially impact the UK’s national security, economy, or important infrastructure, and include threats to essential services, sensitive data, or government functions.

Highly significant incidents represent a more serious threat, often requiring coordinated cross-government responses due to their potential to cause widespread disruption or long-term damage to national interests.

A call for immediate action

The NCSC’s message to British businesses is unequivocal: hesitation is now a vulnerability. Horne emphasised that “the best way to defend against these attacks is for organisations to make themselves as hard a target as possible,” adding that “the future of their business depends on the action they take today.”

In response to the escalating threat, the government has written to chief executives and chairs of leading businesses, including all FTSE350 companies, highlighting the importance of making cyber resilience a board-level responsibility. The coordinated approach recognises that protecting the UK economy requires government and business working together.

Daniel Shiu, Chief Cryptographer at Arqit said resilience depends on more than reactive incident response. “It starts with knowing where the weaknesses lie in their own systems. Identifying weaknesses in how data is protected and managed is just as important as defending against external threats.”

New resources for businesses

To support organisations to strengthen their defences, the NCSC has launched two initiatives. The Cyber Action Toolkit, released alongside the annual review, helps sole traders and small organisations implement foundational security controls.

It’s designed to help smaller businesses – often the most vulnerable – put basic cybersecurity measures in place. The NCSC is also urging businesses to implement Cyber Essentials, a certification scheme that helps organisations guard against the most common cyber attacks.

For UK organisations certifying their entire organisation with an annual turnover below £20 million, the scheme now includes automatic cyber liability insurance – a significant incentive that addresses both security and risk management concerns.

The broader implications

The surge in UK cyber attacks reflects a global trend of increasing digital threats, but the acceleration is particularly stark. The 129% year-on-year increase in nationally significant incidents suggests that adversaries are becoming more aggressive, more capable, or more focused on British targets – likely all three.

The concentration of Advanced Persistent Threat actors in the incident data points to a strategic dimension beyond financial crime. Nation-state actors and criminal groups operate with different motivations and capabilities from those of typical cybercriminals, often pursuing espionage, intellectual property theft, or infrastructure disruption alongside, or instead of, financial gain.

The NCSC has made it clear that collective defence requires action from every organisation. As Horne concluded: “The time to act is now.”

For British businesses in all sectors, the statistics in this annual review serve as warning and wake-up call. With four nationally significant cyber attacks occurring a week, the questions are no longer whether an organisation might be targeted, but when and whether it’s protected

Want to experience the full spectrum of enterprise technology innovation? Join TechEx in Amsterdam, California, and London. Covering AI, Big Data, Cyber Security, IoT, Digital Transformation, Intelligent Automation, Edge Computing, and Data Centres, TechEx brings together global leaders to share real-world use cases and in-depth insights. Click here for more information.

TechHQ is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.