Breach intelligenceThe true cost of data breaches
A breach is not one invoice. It is investigation, interruption, recovery, regulatory action and lost trust. These figures have names, dates and sources, so the scale can be judged properly.
- Named sources
- Defined scope
- Real incidents
High numbers. Clear definitions.
The most useful figures say exactly what was measured, across whom, and when. Each source opens the underlying evidence.
Average cost reported for a UK data breach
IBM's 2025 UK edition reports this average across 47 UK organisations in its global study. It is an average, not a prediction of what every breach will cost.
IBM, Cost of a Data Breach Report 2025: UK editionAverage global cost per breach
IBM calculated this average from 600 organisations affected by breaches between March 2024 and February 2025.
IBM, Cost of a Data Breach Report 2025Average time to identify and contain a breach
The global average breach lifecycle still ran for almost eight months in IBM's 2025 research, despite reaching a nine-year low.
IBM, Cost of a Data Breach Report 2025Median ransom payment among organisations that paid
Sophos found the median payment reached $1 million in 2025. Recovery costs were measured separately, so the payment is not the whole loss.
Sophos, The State of Ransomware 2025This has a real home.
Official UK evidence turns abstract cyber risk into businesses, penalties and people affected.
of UK businesses identified a breach or attack
That is approximately 612,000 businesses in the 12 months covered by the survey. The measure includes attempted attacks such as phishing, not only successful data loss.
UK Government, Cyber Security Breaches Survey 2025in ICO fines following the Capita breach
The ICO fined two Capita companies after personal information belonging to 6.6 million people was stolen in a 2023 cyber attack.
Information Commissioner's Office, October 2025people affected in one documented UK incident
The Capita case affected hundreds of pension schemes and shows how one compromise can spread through a trusted service provider into millions of lives.
Information Commissioner's Office, October 2025Why breaches keep happening
One evidence set, four prominent patterns. These percentages come from Verizon's analysis of more than 22,000 security incidents, including 12,195 confirmed breaches.
Human involvement
60%The human element featured in 60% of breaches analysed in Verizon's 2025 dataset.
Verizon, 2025 Data Breach Investigations ReportLearn more about Human involvementVulnerability exploitation
20%Exploitation of vulnerabilities accounted for one in five initial access vectors in the 2025 report.
Verizon, 2025 Data Breach Investigations ReportLearn more about Vulnerability exploitationThird-party involvement
30%Third parties were involved in 30% of breaches, twice the proportion measured in the previous report.
Verizon, 2025 Data Breach Investigations ReportLearn more about Third-party involvementRansomware
44%Ransomware is present in 44% of all breaches analysed in 2025.
Verizon, 2025 Data Breach Investigations ReportLearn more about RansomwareMajor breaches that made headlines
38 verified incidents, updated in real time.
PowerSchool
2026Unauthorized Access
Records
62.4M
DISA Global Solutions
2026Unauthorized Access
Records
3.3M
Globe Life
2026Unauthorized Access
Records
850K
Co-operative Group
2026RetailRansomware (Scattered Spider)
Records
6.5 million members (names, contact details, dates of birth)
Harrods
2026RetailAttempted network intrusion
Records
Attempted intrusion, limited disruption
Legal Aid Agency (Ministry of Justice)
2026GovernmentData breach and exfiltration
Records
2.1 million applicants (financial, criminal, contact data since 2010)
Adidas UK
2026RetailThird-party customer service breach
Records
Customer contact details (subset)
Peter Green Chilled
2026Logistics / Food supply chainRansomware
Records
Order and logistics data
Jaguar Land Rover
2026Automotive / ManufacturingRansomware
Records
Production and IT systems disrupted
Collins Aerospace (RTX)
2026Aviation / TransportRansomware on third-party check-in software
Records
Check-in and boarding disruption across Heathrow, Brussels, Berlin
Kido International
2026Education / ChildcareRansomware and extortion
Records
Photos and personal data of ~8,000 children
Asahi Group
2026Manufacturing / BeveragesRansomware
Records
Production systems disrupted
NHS Scotland
2026HealthcareRansomware (INC Ransom)
Records
Patient and staff records (regional)
Hertz
2026Supply Chain
Records
Undisclosed
Marks & Spencer
2026RetailRansomware (Scattered Spider / DragonForce)
Records
Customer contact details, order history
Showing 15 of 38 verified breaches
Reduce what an attacker can reach
Offline Secure Storage® places selected critical data on dedicated hardware that is physically disconnected between authorised sessions, reducing its exposure to connected-system attacks.
Stop being the next case study
Every breach on this page started with data that was reachable. Remove yourself from the target list with physically disconnected storage.
From £360 a month including VAT. 36-month commitment. First payment at checkout.