UK organizations file record cyber incident reports with privacy regulator

UK organizations filed 1,371 cyber incident reports with the Information Commissioner’s Office between July and September 2026, exceeding the previous quarterly record set in 2023, according to The Record. The outlet said Britain is on track to top its previous annual cyber incident record from 2023. Including non-cyber breaches, all data security incident reports reached 4,604 during the same period, a quarterly peak.

Ransomware reports to the agency are on a downward trend. The agency recorded 1,253 ransomware incidents in 2023, then 752 in 2024 and 620 in 2025. The opening nine months of 2026 saw 321 ransomware reports. Third-quarter ransomware reports numbered 102, a drop from 111 in the second quarter, and Recorded Future News reported that the ICO investigated fewer ransomware incidents despite rising reports.

Retail and manufacturing recorded the most incidents, rising from 205 to 296 between the second and third quarters. Charity and voluntary organization reports nearly doubled, climbing from 79 to 145. Online technology and telecom reports climbed from 76 to 120, while education and childcare, one of the six hardest-hit sectors, dropped from 135 to 115. Sector reporting shifted between the second quarter and the third quarter of 2026 as some industries logged more incidents and others fewer.

The regulator opened just 18 investigations across the 1,371 third-quarter cyber incidents, a small slice of the quarterly total. Most ICO cases end with informal action rather than formal investigation, leaving the majority of reports without a formal probe. Dozens of provisional cases have yet to reach an outcome, and provisional figures rarely differ much from the final confirmed count.

The watchdog has published security incident figures for several years, but official government statements rarely mention them and the numbers remain little known. Recorded Future News previously reported that the ICO investigated fewer ransomware incidents despite rising reports.

Data from leak sites where ransomware cartel names victims indicates a rise in attempted extortions. Leak sites have named about 350 British organizations so far in 2026, up about 50 percent compared with 2025. The UK increase is far larger than the global average rise, which is about 25 percent. Industry sources said a growing number of UK entities listed on extortion leak sites are coming to them for help.

Some British incident response firms said staff were turning away clients because demand had surged. Other firms reported heavy workloads but were not overwhelmed. Firms balance keeping specialists busy while keeping spare capacity open for sudden attack spikes. Demand for incident response help has grown alongside the rise in reporting.

Rafe Pilling, director of threat intelligence at Sophos, said Qilin, The Gentlemen and n0n, along with smaller recent groups, were primarily responsible for the rise. Pilling called leak-site data an imperfect measure but said it suggests extortion and ransomware are rising, especially in Britain. He described the rise as a recent global surge but a steady year-long climb in Britain. “In the UK it has been a steady climb all year,” Pilling said.

Sophos counted more than 1,200 newly named victims globally in October 2026, a monthly high for the company. The October figure was nearly two-thirds higher than October 2025. Sophos expects November 2026 to surpass the year’s monthly average.

Pilling said established cybercrime groups are incorporating artificial intelligence into their operations, and that AI agent frameworks play a role in more attacks now. Jonathon Ellison of the National Cyber Security Centre said AI is speeding up the discovery and exploitation of vulnerabilities. NBC News said attacks that use artificial intelligence are behind the rise.

An ICO spokesperson said organizations in every sector face a major threat from cyber attacks. Pilling said basic security controls could still stop many successful attacks. He said patching internet-facing flaws and using phishing-resistant multifactor authentication and passkeys would lower risk.

The watchdog’s data covers just incidents organizations find and report. Experts call the ICO figures the best available yardstick for counting real incidents. Most reported incidents go into the “other cyber incidents” catch-all category, separate from phishing, ransomware and malware. The character of the recent incidents remains unidentified, and unclear whether the ICO ransomware category covers only encryption attacks or includes data extortion.