Ransomware Incidents On the Rise in the UK

Ransomware attacks targeting U.K. organizations continued to rise last year concluded the British government despite a low reporting rate by victims. The findings come as the government is considering banning public sector organization from paying ransom and mandating incident reporting.

See Also: Demostración Del Producto: Backup Y Recuperación De VM

The government surveyed its 2,180 businesses, 1,081 charities and 574 education institutions for an annual survey published Thursday.

Overall hacks targeting British organizations reduced in the last 12 months but ransomware attacks “significantly increased” between 2024 and 2025.

“The estimated percentage of ransomware crime increased from less than 0.5% in 2024 to 1% in 2025, which equates to an estimated 19,000 businesses in 2025,” the report said.

Recent high-profile incidents include a November 2024 ransomware hack against a National Health Service hospital in Northwest England that prompted the facility to cancel outpatient appointments. A ransomware hack on another IT vendor led to blood shortages across U.K. hospitals last year (see: UK Blood Stocks Drop After Ransomware Hack).

The report, compiled by the Department of Science, Innovation and Technology, added 4% of large businesses and 3% of medium businesses paid ransom.

“External reporting remains uncommon, with only a third of organizations having guidance on when to report a cyber breach or attack externally,” the report said. Under the existing U.K. laws, victims are required to disclose hacks within 72 hours to the Information Commissioner’s Office, but only if any cyberincident resulted in the leak of personal data.

The U.K. government has cited a lack of data on ransomware hacks as a challenge in understanding the scale of the threat posed by hackers to the country. In February, the government opened a consultation proposing mandatory ransomware incident reporting and a limited ransom payment ban (see: UK Home Office Ransom Ban Proposal Needs More Clarity).

The requirement, which is likely to be incorporated into the U.K. Cyber Security and Resilience Bill, would ban government agencies or operators of critical infrastructure from paying ransom and report any incidents within 72 hours.