Cybercrime in the UK: A Year in Review
In the 12 months leading up to April, the UK government reported that businesses experienced 7.78 million cyberattacks. These incidents ranged from email phishing schemes to significant data breaches, many of which could have been mitigated with stronger cybersecurity measures.
Threats to Democratic Institutions
With 21% of surveyed businesses indicating they face breaches about once a month, the impact extends beyond commerce, posing a risk to democratic institutions.
Security Breaches at the Electoral Commission
The UK’s intelligence agency, GCHQ, revealed that the Electoral Commission was compromised by Chinese hackers. Subsequent investigations by the Information Commissioner’s Office highlighted the Commission’s failure to employ basic security measures to safeguard voters’ personal information.
The report criticized the Electoral Commission for lacking an effective patch management system to guard against known Windows vulnerabilities and for not having a legally mandated password management policy for its staff.
Financial Impact of Cyber Incidents
In the 2023/24 period, 3% of businesses suffering from cyberattacks reported monetary theft, while 2% paid ransoms. Yet, some of the most costly incidents were due to data breaches rather than direct financial theft or ransomware attacks.
According to IBM, the average cost of a data breach for UK businesses in the 2023/24 financial year was $4.53 million.
Major Data Breaches in the UK
| Breach | Year | Cost to Business* | Number of People Affected |
|---|---|---|---|
| Dixons Carphone | 2017-2018 | Unknown | 14 million |
| British Airways | 2018 | £20 million | 380,000 to 500,000 |
| Virgin Media | 2020 | £4.5 billion | 900,000 |
| EasyJet | 2019-2020 | Unknown | 9 million |
| TalkTalk | 2015 | £60 million | 157,000 |
*Costs estimated by CCN based on fines, compensation claims, and public disclosures.
Alongside international breaches involving companies like Dell, Facebook, eBay, and Equifax, British consumers have also faced a series of local cyberattacks in recent years. Affected businesses include airlines such as British Airways and RyanAir, mobile carriers like 3 Mobile and TalkTalk, and hospitality firms like JD Wetherspoon and Camelot Group, the operator of the UK’s national lottery.
The Human Cost of Cybersecurity Failures
The financial toll on businesses is only part of the story; the true victims are often the individuals whose personal data is compromised.
In the case of the Electoral Commission breach, hackers accessed personal information of approximately 40 million people, including names, home addresses, email addresses, and phone numbers.
The Commission downplayed the breach by noting that much of the stolen data was already publicly accessible. Nevertheless, the exposure of sensitive records underscores the severity of the security lapse.
While victims of corporate data breaches can often join class action lawsuits for compensation, those affected by public sector security failures have fewer avenues for recourse.
