UK Small Business Breach Costs: What One Ransomware Week Really Costs | APX Digital

43% of UK businesses were breached last year. The median cost they reported was £0. Here's why your planning shouldn't stop at the median, and what one genuinely bad week does to a small firm's numbers.

The breach maths every owner should do before the incident, not during it.

As of September 2026, the freshest official picture is the government's Cyber Security Breaches Survey 2025/2026 (DSIT and the Home Office; fieldwork August to December 2025). Two of its numbers get quoted past each other so often it's worth lining them up properly.

The two numbers that are both true

Number one: most breaches are cheap. Among businesses that identified a breach or attack, the median perceived cost of the most disruptive one was £0. The middle 50% of responses fell between £0 and £200. 72% said recovery took "no time at all", and 87% restored operations within 24 hours. That's the boring majority: a phishing email that got reported, a password reset, everyone back to work.

Number two: the tail is where businesses die. The survey's own 95th-percentile figures: £4,000 for micro and small businesses, rising to £10,000 for medium/large. Among businesses that suffered an actual outcome from a breach, 11% reported being stopped from carrying out day-to-day work, loss of revenue or share value doubled-ish year on year (2% to 5%), and reputational damage rose from 1% to 3%. And cyber-facilitated fraud, where a breach actually moves your money, hit an estimated 3% of all businesses (~43,000 firms), with the top 10% of those cases costing £12,500 or more.

Averages hide this. Medians hide it harder. You don't get to choose which percentile you live in.

The ransomware week, modelled honestly

Ransomware is rarer than the panic suggests: 1% of businesses reported a ransomware attack in 2025/2026, down from 3% the two prior years (though it rose among charities to 1%). Rare and catastrophic is exactly the profile you plan for, not ignore.

So do the arithmetic for your own firm. This is a worked example, not a government statistic. Fill it with your real numbers:

A five-person service firm billing £2,000 a day isn't unusual. A week out of operation is £10,000 of unbilled work before a single contractor invoice, which already exceeds the survey's £4,000 95th-percentile perceived cost, because owners systematically count the clean-up and not the trading gap. Multiply the trading gap by "the backups needed rebuilding from scratch, not just restoring" and you're in the tail.

The one defence that changes every line in that table is a backup you have actually restored from. The one that costs real money is the incident you didn't prevent because the lockers, passwords and mail settings were never done. Our PSTI default-password audit checklist takes one evening; the M365 mail-settings fix is the other half of the prevention side.

What "hardened" looks like before you pay us

• Backups: offline or immutable copy, restore-tested, someone can name the last successful restore date.
• MFA on email, VPN, and anything admin. Microsoft's own security-defaults page states more than 99.9% of common identity attacks are stopped by MFA plus blocking legacy authentication.
• Mail tenant configured, not defaulted (see the defaults post).
• Device passwords changed and update periods tracked (the audit list).
• An incident plan with one page and a phone number on it, because the first hour of a breach is decisions, not IT.

We quote cyber work per business: there's no flat card price, because a two-person practice and a fifty-seat manufacturer are not the same engagement.

Want your own breach maths done properly? apxdigital.io/cyber

Info@apxdigital.io · 07753 226214 · Birmingham / Coventry / West Midlands