With the cyber scars from last year’s wave of high-profile ransomware attacks still fading, new government-sponsored research warns that the true financial toll of these incidents remains dangerously underestimated.

Though big-name breaches like M&S and Jaguar Land Rover grabbed headlines with losses in the hundreds of millions, the fresh figures produced by auditor KPMG reveal that for the average UK business, a serious cyber-attack still means a £195,000 hit.

Previous figures show that nearly half (43%) of UK businesses suffered cyber-attacks last year, equivalent to over 600,000 organisations, resulting in an estimated £14.7 billion lost every year, or 0.5% of the country’s GDP.

According to KPMG’s report, the UK’s top-performing industries are also its most vulnerable, with average losses reaching £337,000 in information services, £334,000 in management, £331,000 in entertainment, £330,000 in manufacturing, and £309,000 in finance.

However, the government warned that these headline figures fall short of capturing the wider economic damage of cyber-attacks.  

“Historically, our understanding of the economic impact of cyber-attacks has focused on immediate financial costs to affected organisations, such as businesses,” said the government’s report.

“This narrow focus risks underestimating the true cost of cyber-attacks to the UK economy. To address this, the government funded independent research to better understand and quantify the wider economic impact of cyber-attacks on the UK economy.”

For example, KPMG found that a ransomware attack causing a three-day online banking outage could rack up costs between £5.5 million and £231 million, while a one-day cyber disruption to video streaming services could cost the economy between £2.8 million and £197 million.

Even more damaging would be a coordinated attack taking out the UK’s fragile rail network, not an inconceivable event given recent breaches in ticketing, station Wi-Fi, and rail data systems. 

According to KPMG, a hypothetical, week-long cyber incident targeting the rail network could result in a cost of up to £1.8 billion, including a direct financial cost to Network Rail in the region of £123 million, and a cost to passengers of £281.3 million.

Recommended reading

• NHS Scotland Invests £3M in AI Anti-ransomware Software
• UK Facing 4 Major Cyber-Attacks Each Week, Warns NCSC
• Winners Announced For The 2025 Scottish Cyber Awards

Meanwhile, a separate report from Alma Economics warns that IP and knowledge theft cost the UK economy up to £8.5 billion last year, as much as 0.3% of GDP, calling this a potentially existential threat to SMEs, with stolen IP often used to develop rival products and undercut prices.

The new figures come as the government begins pushing its Cyber Security and Resilience Bill through parliament, hoping to highlight the need for more robust measures that keep pace with attackers’ capabilities, saying that previous legislation, like the Network and Information Systems Regulations (2018), has fallen out of date and is insufficient to tackle the current threat landscape.

Publishing the headline findings from the sponsored reports, the government said that the Cyber Bill will aid in the defence of critical national infrastructure, and make “essential and digital services more secure in the face of cybercriminals and state actors who want to disrupt our way of life.”