323 UK Firms Hit by Ransomware in a Year — More Than Half Were SMEs

The numbers

City of London Police reported that 323 organisations disclosed ransomware attacks in the UK between April 2025 and March 2026 — more than 26 successful attacks every month. Over half of those reports (175) came from small and medium enterprises. Average reported financial losses reached around £270,000, a 50% increase on the previous year, and police believe the real figure is higher because businesses under-report losses.

Manufacturing was hit hardest (42 reports), followed by scientific and technical services (21) and education (19).

Why attackers prefer small businesses

It's counterintuitive, but a well-defended large enterprise is often a worse target than a small firm with an unpatched firewall. Ransomware operators aren't chasing headlines — they're chasing the path of least resistance. SMEs are more likely to lack a dedicated incident response capability, run unpatched edge devices, and pay out quickly because downtime is existential rather than merely expensive.

What actually reduces risk

Police and industry guidance converge on the same short list:

1. Backups that are tested and kept offline — a backup you've never restored from isn't a backup, it's a hope.
2. Patch management — most ransomware entry points are known vulnerabilities in software that hasn't been updated, not novel zero-days.
3. Access controls — MFA everywhere, least-privilege accounts, no shared admin logins.
4. Follow NCSC guidance — the UK's National Cyber Security Centre publishes free, small-business-specific advice.

If you don't currently have anything watching for the second point — outdated dependencies and missing patches — a Security Score scan covers exactly that ground automatically.

Sources: City of London Police, Infosecurity Magazine