How to Report Cybercrime in the UK
A clear, direct answer to this question — written for UK business owners and IT decision-makers.
Direct Answer
UK businesses should report cybercrime to Action Fraud (actionfraud.police.uk or 0300 123 2040). Data breaches involving personal data must also be reported to the ICO within 72 hours under UK GDPR. If the attack is ongoing or critical infrastructure is affected, contact the NCSC. Report promptly — delayed reporting can increase regulatory penalties and reduce insurance claim success.
Key Points
What you need to know.
The Short Answer
A concise overview of what you need to know.
For UK Businesses
How this applies specifically in the UK context.
Cost Considerations
What to expect in terms of investment and ongoing costs.
Next Steps
What you should do with this information.
Quick Comparison
| Feature | Option A | Option B |
|---|
Frequently Asked Questions
Organisations with Cyber Essentials certification are 92% less likely to make a claim on their cyber insurance. Certification is mandatory for UK government contracts involving sensitive data. Only 3% of UK businesses are currently certified, giving certified businesses a competitive advantage.
Phishing is the most common attack type, identified by 85% of businesses that experienced a breach (DSIT 2025). Phishing accounts for 93% of cyber crimes against businesses. AI-powered phishing has driven a 204% increase in phishing emails delivering malware in 2025.
43% of UK businesses experienced a cybersecurity breach or attack in the past 12 months, according to the DSIT Cyber Security Breaches Survey 2025. For medium-sized businesses, this figure rises to 67%. Phishing remains the most common attack type, affecting 85% of businesses that reported a breach.
The first hour after detection is considered the golden hour that determines outcome severity. Organisations that detect breaches internally save an average of $900,000 in costs. Only 22% of UK businesses have a formal cybersecurity incident management plan in place.
The top threats are phishing (85% of breaches), ransomware (doubled year-on-year), business email compromise (increased 33% in 2025), and supply chain attacks (35.5% of all breaches now originate from third parties). AI-powered attacks are accelerating all of these threat categories.
Need More Detail?
Speak to an AMVIA expert for advice tailored to your business.
Related Questions
Cybersecurity Guide for UK SMEs
A comprehensive guide to cybersecurity controls and incident response planning for UK businesses.
What Is Ransomware?
Understanding ransomware attacks — and what to do if your business is affected.
Cyber Essentials Certification
Certified businesses are 92% less likely to make a claim on their cyber insurance — and better prepared for incidents.