Almost half UK businesses suffered cyberattack or security breach last year, figures show

'Simple steps to remove basic weaknesses' would go a long way to protecting key data, expert says

The WannaCry ransomware hit businesses and public services around the world last year (EPA)

Nearly half the businesses in the UK have fallen victim to cyberattacks or security breaches in the last year, costing them each thousands of pounds, new data shows.

The government report also found a fifth of charities had been affected, in a detailed look at how organisations of all sizes are at risk of being targeted.

The 2018 Cyber Security Breaches Survey found 19 per cent of charities and 43 per cent of businesses had reported cyber security breaches or attacks in the last 12 months.

That rose to seven in 10, or 72 per cent, among large businesses and a similar proportion – 73 per cent – among the largest charities with incomes of £5m or more, the authors said.

The most common breaches or attacks involved fraudulent emails, attempts by scammers to impersonate the organisation online and viruses and malware.

Files were temporarily or permanently lost, software or systems corrupted, firms and charities had websites slowed or taken down and money, assets and intellectual property were stolen.

Typically, organisations incurred no specific financial cost from cybersecurity breaches, according to the report.

But it said that where breaches did result in a “material outcome”, the costs could be significant.

The average financial impact was £3,100 for businesses and £1,030 for charities, the study published by the Department for Digital, Culture, Media and Sport found.

It concluded that businesses and charities needed to consider their “organisational cultures”, saying some organisations continued to see themselves as “offline” or too small to be at risk.

Charities were typically behind businesses when it came to seeking information, advice or guidance, training staff and having written policies on cyber security, the paper said.

The findings follow a warning from intelligence officials that charities holding vast quantities of personal data and payment information are at risk of potentially devastating online attacks.

In one case flagged up in that report, published last month, a charity lost £13,000 after its chief executive’s email was hacked.

Ciaran Martin, chief executive of the National Cyber Security Centre, a part of GCHQ, said: “Cyberattacks can inflict serious commercial damage and reputational harm, but most campaigns are not highly sophisticated.

“Companies can significantly reduce their chances of falling victim by following simple cybersecurity steps to remove basic weaknesses.”

Digital minister Margot James said: “We are strengthening the UK’s data protection laws to make them fit for the digital age but these new figures show many organisations need to act now to make sure the personal data they hold is safe and secure.”

The government is investing £1.9bn to protect the nation from cyber threats, she added.

Last year, the WannaCry malware infected computers around the world, including in the NHS, holding data to ransom and demonstrating the vulnerability particularly of older, and out-of-date, software.

Additional reporting by PA