September 15, 2026 | In the News

Nearly Two-Fifths of U.K. SMEs Hit by Cyberattacks

For years, cyberattacks were anomalies, fodder for headlines. Now they’re an undeniable part of daily workflow, requiring a fundamental shift from reactive defense to a constant readiness for cyber resilience as they cost businesses time, money, and reputational risk.

BBC Business Today recently highlighted this cybersecurity narrative shift, reporting that the total number of attacks on small to medium U.K. businesses are staggering, with 39% of U.K. SMEs reporting a successful hack over the last 12 months. But U.K. firms are surprisingly resilient, recovering in an average of just 24 hours – which can still feel like a lifetime to customers who have lost data or investors who are experiencing fallout from reputational damage.

Those numbers come from the Hiscox Cyber Readiness Report, an international study conducted with Wakefield Research that surveyed 6,800 cybersecurity decision makers and subject matter experts within businesses of fewer than 250 employees across 10 global markets.

The global data from Hiscox also supports why upgrading data protection and cyber governance is no longer optional:

• Globally, attack rates and costs. Nearly one in three organizations worldwide have experienced a successful cyberattack over the last year. Incidents cost businesses globally an average of $52,000 and cause about 32 hours of downtime.
• Disruption derails growth. The repercussions of cyberattacks go far beyond immediate financial loss. Nearly a third of businesses report that cyberattacks have directly derailed growth, expansion, or new business initiatives.
• Investing in proactive resilience. Businesses are now spending almost as much on proactive resilience ($51,000 on average) as they lose to actual incidents.
• Focusing on technology and talent. To increase their cybersecurity, more than half of businesses are investing in new technology (51%) and adding dedicated cybersecurity personnel to their teams (55%), while nearly two-thirds (62%) of businesses are actively revising their employee training.

Eddie Lamb, Global Head of Cyber at Hiscox, told the BBC that while big corporate hacks may make for big headlines, small and medium enterprises (SMEs) are the backbone of the economy and a constant target for hackers.

These ongoing threats are creating serious operational disruption, chronic anxiety within organizations, and reputational damage, causing business leaders to fundamentally reassess and overhaul their technical setups. The story around cyber risk is changing fast as the financial and operational costs pile up.

“When organizations are under constant threat of cyberattack, basic defenses are no longer enough to survive. It takes uncompromising preparation and resilience,” says Nathan Richter, Senior Partner at Wakefield Research. “We are proud to partner with Hiscox to field this global research which so clearly proves why business leaders are fundamentally changing their approach to cyber risk.”