UK Businesses Under Siege: Over Half Hit by Cyberattacks in 2024—Are You Next?

31 Mar

Let’s skip the polite intro.

If you own or run a UK business, there’s a 50/50 chance you got digitally slapped last year. That’s not speculation—that’s straight from multiple sources (see receipts at the end). And if you didn’t get hit? Lucky you. But don’t mistake luck for strategy.

The Threat Isn’t Coming—It’s Already Here

In 2024, the average UK business saw a new cyberattack every 44 seconds. Ransomware, phishing, supply chain compromise—you name it. If your cybersecurity budget looks like an afterthought, so will your incident response plan when the inevitable happens.

And yes, this applies to small and medium-sized businesses too. Stop thinking cybercriminals only target banks and tech giants. You're a soft target. You’re faster to exploit, slower to recover, and less likely to have lawyers on speed dial. Perfect.

Wake-Up Stats You Can’t Ignore

£55 billion bled out of UK businesses due to cyberattacks in the past five years.
60% increase in ransomware attacks year-on-year.
BT detects 2,000 attack signals per second on its network. That’s per second, not per hour.
Human error remains the biggest door left wide open. Clicking dodgy links, weak passwords, sharing login details. It’s like leaving the vault door open because “you trust your staff.”

“Cyber Resilience” Isn’t a Buzzword. It’s Survival.

Cybersecurity is how you try to prevent a breach. Cyber resilience is how you survive one.

If your business can’t recover operations quickly when (not if) an incident hits, you’re toast. Clients leave. Reputations crumble. Regulators come knocking. You start explaining why backups didn’t work instead of why you didn’t prevent the breach in the first place.

Here’s how to start actually doing something about it.

8 Practical Steps to Not Be the Next Headline

1. Stop Pretending You’re Not a Target

First step to resilience? Get over yourself. Every business has something worth stealing—client data, payment details, credentials, trade secrets. If you’re online, you’re on the radar.

2. Start with a Proper Risk Assessment

Not a checkbox exercise. A real one. Know where your vulnerabilities are. Your IT team might say “we’re fine.” Ask them to show you proof. Spoiler: silence isn’t confidence.

3. Train Your People. Then Train Them Again.

Your team is your first line of defence—or your biggest liability. Phishing still works because humans click stuff. If you’re not training them quarterly (and testing them with fake phish), you’re asleep at the wheel.

4. Implement a Real Incident Response Plan

Not a Word doc from 2019. A working, tested plan with defined roles. Know who does what when things go sideways. Practice like you would a fire drill. Because this is digital arson.

5. Patch. Everything. Always.

Still running unpatched systems? That’s not brave. That’s reckless. Vulnerabilities get exploited within hours of disclosure. Your monthly patch schedule isn’t cutting it anymore.

6. Monitor. Like a Hawk on Caffeine.

If you’re not actively monitoring network activity, someone else is—only they’re doing it to you. MDR, EDR, SOC—don’t just throw acronyms around. Implement something that alerts before your backups are encrypted.

7. Backups That Actually Work

You’ve got backups? Great. Have you tested restoring from them recently? Didn’t think so. Ransomware doesn’t care what your policy says—it cares whether you can recover without paying.

8. Multi-Factor Authentication Everywhere

If you’re not using MFA across your systems, you’re basically letting attackers in with a ‘please knock’ sign. MFA is annoying—until you compare it to shutting down your business for a week.

Leadership: This One’s on You

Cyber resilience isn’t just IT’s job. It’s a board-level problem. If you don’t have cybersecurity on the agenda every quarter—preferably every month—you’re gambling.

And make no mistake: regulators are watching. Clients are watching. Investors are watching. After an incident, nobody wants to hear that the board “didn’t know.” They’ll want to know why you weren’t asking the right questions in the first place.

Bonus: The Supply Chain Weakness

Yes, your suppliers matter too. You can be Fort Knox, but if your outsourced HR platform has a password of “123456”—guess what? You're exposed. Vendor due diligence isn’t optional anymore.

Final Thoughts

Cyber resilience is no longer optional—it’s business critical.

So ask yourself:

What’s your recovery plan?
What’s your ransomware response?
When was the last time your staff were tested?
Is your leadership truly engaged?
And can you prove any of it if the ICO comes knocking?

Because if you can’t answer those questions with confidence, you’re not resilient. You’re just lucky.

And luck always runs out.

#	Source	Publisher	Link	What It Tells Us (a.k.a. Why You Should Care)
1	Over Half of UK Businesses Faced Cyberattacks Last Year	HR News	Read It	Yep, more than 50% of UK businesses were hit. That’s not a warning—it’s a happening. Still thinking you’re too small to be a target?
2	Half of UK businesses hit by cyber breaches in 2024	ITR Portal	Wake Up Call	Another credible outlet confirming the breachfest. If you’re not investing in cyber resilience, you’re effectively writing off your business continuity.
3	Cybersecurity Statistics 2024	NinjaOne	Brutal Stats	Every 44 seconds. That’s how often a business is attacked. Let that sink in. And yes, it’s getting worse. Ransomware? Through the roof.
4	Cybercrime in the UK	Statista	Crunch the Numbers	Real data. Real damage. Spoiler: SMEs are not immune. If anything, they’re prime targets because they're easy pickings.
5	Cyberattacks cost UK businesses £55 billion in 5 years	Reuters	£££ Drain	£55 billion. Gone. Burned. That’s the price tag for five years of “we’ll sort it later.” Got a budget? Good. Use it before it’s used against you.
6	BT spots 2,000 cyber threats per second	Reuters	2,000 Hits/Second	One of the UK's biggest networks is swatting away thousands of threats per second. If they’re struggling, what chance does your £25-a-month router have?
7	Why Cyber Resilience Matters	University of Tennessee	Academic Truth	Yes, even academics agree: cyber resilience is the backbone of business survival in the digital age. This isn’t theoretical anymore.
8	How to Build Cyber Resilience	Immersive Labs	The 'How' Bit	If you’re not sure what cyber resilience actually looks like, start here. No fluff. Just practical strategy.
9	Cyber Resilience Review	Wikipedia (DHS)	Framework Stuff	A US-developed framework, but totally adaptable for UK businesses. Structured, strategic, solid.
10	Cybersecurity Best Practices	CISA	Gov-Grade Advice	From MFA to patching to threat monitoring. This is the bare minimum. If you’re not doing this, you’re already behind.
11	Cybersecurity Belongs in the Boardroom	Financial Times	C-Suite Reality Check	If your execs aren’t talking about cybersecurity weekly, you’re one breach away from headlines, lawsuits, and job losses. Boards: wake up.

Noel Bradford

Noel Bradford – Head of Technology at Equate Group, Professional Bullshit Detector, and Full-Time IT Cynic

As Head of Technology at Equate Group, my job description is technically “keeping the lights on,” but in reality, it’s more like “stopping people from setting their own house on fire.” With over 40 years in tech, I’ve seen every IT horror story imaginable—most of them self-inflicted by people who think cybersecurity is just installing antivirus and praying to Saint Norton.

I specialise in cybersecurity for UK businesses, which usually means explaining the difference between ‘MFA’ and ‘WTF’ to directors who still write their passwords on Post-it notes. On Tuesdays, I also help further education colleges navigate Cyber Essentials certification, a process so unnecessarily painful it makes root canal surgery look fun.

My natural habitat? Server rooms held together with zip ties and misplaced optimism, where every cable run is a “temporary fix” from 2012. My mortal enemies? Unmanaged switches, backups that only exist in someone’s imagination, and users who think clicking “Enable Macros” is just fine because it makes the spreadsheet work.

I’m blunt, sarcastic, and genuinely allergic to bullshit. If you want gentle hand-holding and reassuring corporate waffle, you’re in the wrong place. If you want someone who’ll fix your IT, tell you exactly why it broke, and throw in some unsolicited life advice, I’m your man.

Technology isn’t hard. People make it hard. And they make me drink.

https://noelbradford.com