Search for cyber attack cost UK and you will land on one of two numbers. Either a multi-million global average lifted from a vendor report, or a modest four-figure average from a government survey. Both figures are real. Neither tells you what an incident would cost your business, and budgeting from either one is how finance directors end up either over-insured against the wrong thing or badly under-prepared for a week they cannot trade.

This article builds the bill line by line for a UK organisation, then maps each line back to the exposure that caused it. Because the costs are not random. They trace back to specific, findable things: a staging subdomain nobody decommissioned, a stealer log entry traded in a Telegram channel, a supplier whose ISO 27001 certificate lapsed quietly last spring, a lookalike domain registered three weeks before the first fraudulent invoice.

Why the Headline Average Misleads UK Firms

Global breach cost averages blend incidents at multinational banks and healthcare giants with everything else. The mean is dragged upwards by a small number of catastrophic events involving tens of millions of records, multi-jurisdiction regulators and litigation that runs for years. Import that figure into a board pack for a 200-person engineering firm and you are quoting a number from a different universe.

The more defensible UK starting point is the Cyber Security Breaches Survey, published annually by the Department for Science, Innovation and Technology. It reports the cost of the most disruptive breach by business size, and its figures sit far below the headline numbers in global vendor research. Check the current edition and its publication date before you quote it, because both the methodology and the figures shift year to year.

Even then, the average is the wrong statistic. What matters is the distribution. Most incidents cost very little, because most incidents are phishing attempts that went nowhere. A small tail costs an enormous amount. Your risk is not the average of those two populations; it is the probability that you end up in the tail, and that probability is driven by how much of your estate is exposed and how long it stays that way unseen.

So replace the question. Instead of asking what the average attack costs, ask what five days without your core systems would cost in lost revenue, overtime, expedited freight and missed contractual deadlines. That number you can actually calculate, and it is the one your insurer and your board will engage with.

It also explains why two similar firms, hit by the same ransomware affiliate in the same month, can post wildly different losses. The difference is rarely the malware. It is how long the initial foothold sat unnoticed, and whether the entry point was an asset the IT team was monitoring or one they did not know existed.

The Direct Bill: Response, Recovery and Downtime

Specialist digital forensics and incident response is sold in day rates, and those rates sit well above standard IT consultancy. Out-of-hours, weekend and bank holiday work carries a premium, and attackers have a documented preference for exactly those windows. The gap between a retainer and a cold-start engagement is not just commercial. With a retainer you have agreed scope, signed paperwork and a defined response time. Cold start means negotiating an NDA and a statement of work while someone else holds domain admin.

Then there is the recovery decision nobody plans for. Backups may be intact and still leave you rebuilding rather than restoring, because restoring compromised infrastructure reinstates the compromise. Standing up clean domain controllers, re-imaging endpoints and rotating every credential turns a two-day restore into a three-week programme of work, with contractors on day rates throughout.

Putting a Number on Downtime

Take a manufacturer and divide its annual turnover by the number of days it actually trades. That gives you revenue per lost trading day before you count overtime, expedited freight to recover a delivery schedule, or penalty clauses in customer contracts. A week offline puts several days of that revenue at risk from the downtime alone. Run the same sum for your own business. It takes two minutes and it reframes every security budget conversation you will have this year.

Cyber insurance absorbs part of this, but read the conditions rather than the headline limit. Business interruption cover usually starts only after a waiting period, the excess bites first, and policies commonly carry warranties on multi-factor authentication, patching timescales and maintaining an asset inventory. Claims can be reduced or disputed where you cannot evidence those controls were in place at the time of the incident. An inventory that is accurate on the day of the loss is worth real money.

Regulatory and Legal Costs After a UK Breach

UK GDPR and the Data Protection Act 2018 allow penalties of up to £17.5m or 4% of global annual turnover, whichever is higher, with a 72-hour window to notify the Information Commissioner's Office of a reportable personal data breach. Few organisations ever see the upper tier. What the ICO weighs in practice is more instructive: the nature of the data, the number of people affected, the controls in place, and crucially whether you knew about the weakness and failed to act on it.

That last point is where the cost of ignored exposure becomes explicit. The ICO's £14m penalty against Capita, announced in October 2025 following the March 2023 attack, turned heavily on the handling of early warning signals. We cover the practical lessons in our breakdown of the exposure gaps behind the Capita ICO fine. Review the regulator's published enforcement actions for the current picture rather than relying on remembered figures.

Notification itself is a line item. Writing to hundreds of thousands of individuals means contact centre capacity, postage, a dedicated web page and, often, funded credit monitoring. Add external counsel, who will be instructed from day one, and the group claims that follow large UK breaches, where claimant firms advertise for participants within days of an announcement.

Expectations are also tightening. The Cyber Security and Resilience Bill, introduced to Parliament in late 2025 and progressing at the time of writing, extends NIS-style duties across more of the supply chain. If you sell into regulated sectors or the public sector, assurance demands will land on you regardless of whether the legislation names you directly. Our readiness checklist for the Cyber Security and Resilience Bill sets out what to prepare.

The Costs Nobody Puts in the Budget

Customers do not all leave, but some renegotiate. Enterprise clients respond to a public incident by invoking audit rights, demanding evidence, and occasionally extracting commercial concessions for the inconvenience. That cost never appears in an incident report.

Procurement gates are sharper. Cyber Essentials and Cyber Essentials Plus are mandatory for many central government contracts, and ISO 27001 is routine in enterprise supplier assurance. A certification paused or failed in the aftermath of an incident takes your pipeline with it, and the bids you cannot enter this quarter are revenue you will not book next year.

Then there is the fraud that rides on the publicity. Attackers read breach announcements too, and a firm visibly mid-incident is a soft target for a payment diversion attempt, because everyone is distracted and processes are being bypassed to keep trading. That loss lands on finance, not IT, which is exactly why it rarely gets counted as a cyber attack cost at all.

Finally, the staff time nobody logs. Senior leadership disappearing into a crisis room for a fortnight. Communications and legal review of every statement. And the quieter one: security engineers who worked twenty-one days straight and hand in their notice in month three.

Which Exposures Drive the Biggest Bills

Map the costs backwards and the same small set of exposures keeps appearing.

• Forgotten infrastructure and shadow IT. The staging subdomain left live after a site rebuild. The decommissioned campaign microsite still resolving to an unpatched host. The cloud instance marketing spun up outside change control. These are cheap to find and expensive to discover after an attacker already has. Our guide to where unknown assets hide covers the usual suspects.
• Leaked credential exposure. Credential-driven intrusions usually have a paper trail weeks before the breach: a stealer log entry listing a corporate VPN credential or an active session cookie, traded in dark web and Telegram channels. The cost control here is triage quality. Separating consumer noise from genuine corporate identities is the whole job, because alerting on everything trains teams to ignore the alert that mattered. Start with our 48-hour stealer log triage process.
• Supplier compromise. An incident on someone else's estate does not stay on someone else's P&L. You can end up carrying notification, customer communication and contractual penalties for a breach you did not suffer. Tracking supplier accreditations, including an ISO 27001 certificate quietly lapsing, changes both your risk and your position in the renewal conversation.
• Lookalike domains. The pattern is consistent: register, age quietly for weeks, then run the payment diversion campaign. Detection at registration plus early evidence collection makes takedown faster and far cheaper than unwinding a fraudulent payment. The five signals of domain spoofing are worth knowing before your finance team meets one.
• Exposed executive and employee identity data. Personal email addresses, home locations and reused passwords belonging to your finance director are the raw material for convincing social engineering, and they are usually sitting in public breach corpora already.

Building the Business Case for Continuous Visibility

You cannot price risk on an estate you cannot see, so discovery comes first. Mapping every internet-facing asset, including the ones no internal team claims ownership of, gives you a baseline that a CMDB built from internal records never will.

After that, the value is in change detection. New exposure appears constantly, from a certificate expiring to a developer opening a port, and the difference between finding it in days and finding it at the point of compromise is most of the cost difference described above. Dual scanning across infrastructure and web applications matters here too, but so does deduplication: infrastructure and application scanners regularly report the same underlying issue twice, and engineer hours spent re-triaging duplicates are hours not spent closing real exposure. Treat deduplication and auto-resolution as a cost control, not a tidier dashboard.

Layer on dark web, Telegram and credential monitoring, with dedicated VIP coverage for the handful of people most likely to be impersonated. Add supplier threat intelligence and accreditation tracking so inherited risk is visible before it becomes your notification bill.

Then report it in money. A weekly summary of what changed on your external attack surface, sitting next to the downtime cost it helps avoid, is the version a board will fund. For a firm that loses a meaningful slice of revenue with every lost trading day, continuous external attack surface management is an annual operating cost measured against a single bad week. The arithmetic is not subtle, and you should run it with your own numbers rather than anyone else's averages.

If you want to see what your external exposure looks like from the attacker's side before you build that business case, take a look at the DarkInvader platform and the discovery it performs across your public-facing estate.

Frequently Asked Questions

How much does a cyber attack cost a UK business on average?

There is no single reliable figure, and the averages quoted most often come from global enterprise research that does not reflect a UK mid-market firm. The DSIT Cyber Security Breaches Survey, published annually, is the most defensible UK source for the cost of the most disruptive breach by business size, and its figures are far lower than global vendor averages. The more useful calculation is your own revenue per trading day multiplied by a realistic recovery period.

What makes up the biggest share of cyber attack costs?

For most organisations it is operational disruption rather than fines: lost trading days, recovery labour, overtime and the knock-on costs of missed delivery commitments. Regulatory penalties attract the headlines but affect a minority of incidents. Commercial fallout, including paused certifications and lost tenders, is frequently larger than the incident response invoice and almost never forecast.

What fines can the ICO issue after a UK data breach?

Under UK GDPR and the Data Protection Act 2018, the maximum penalty is £17.5m or 4% of global annual turnover, whichever is higher, with a lower tier for certain infringements. In practice the ICO weighs the sensitivity of the data, the number of people affected, the controls in place and whether the organisation acted on warning signs. Reportable personal data breaches must be notified to the ICO within 72 hours.

Does cyber insurance cover the full cost of a cyber attack?

Rarely. Excesses apply, business interruption cover usually begins only after a waiting period, and reputational and pipeline losses sit outside most policies entirely. Policies also carry conditions on controls such as multi-factor authentication, patching timescales and asset inventory, and a claim can be reduced or disputed where you cannot evidence those controls were operating at the time of the incident.

How does the cost of attack surface monitoring compare with the cost of an incident?

Continuous external attack surface management is an ongoing subscription cost, while a serious incident concentrates response fees, downtime, legal costs and commercial damage into a few weeks. Compare the two using your own downtime figure rather than a published average: for many mid-market firms, a single lost trading day exceeds a meaningful share of a year's monitoring. Monitoring does not prevent every attack, but it shortens the window in which unknown exposure goes unnoticed, and that window is what drives the largest bills.