# Cyber security checklist: Cyber Incident Cost

> The Cyber Incident Cost carries 6 published figures read from 2 sources' own pages; the 3 published figures given by attack type run from 1 to 38 percent, read 12 October 2026.

Outsourced IT Quotes · https://outsourceditsupportquotes.com/datasets/cyber-incident-cost/ · computed 2026-10-19

**Range by attack type:** 1 to 38 % (range 1 to 38 %; 6 published figures; 2 of 7 sources read publish one).

2 of the 7 named sources read in full publish a figure; 5 publish none, read 12 October 2026.

## By jurisdiction and business size and attack type

| Breakdown | Median | Range | Sources |
|---|---|---|---|
| jurisdiction GB | 43 % | 43 to 43 % | 1 |
| jurisdiction US | 83 % | 83 to 83 % | 1 |
| business size medium | 65 % | 65 to 65 % | 1 |
| attack type phishing | 38 % | 38 to 38 % | 1 |
| attack type ransomware | 1 % | 1 to 1 % | 1 |
| attack type impersonation | 12 % | 12 to 12 % | 1 |

## Every figure, with its source

One row per source: the figure the source's own page publishes, the page, and the day it was read.

| Source | Figure | Breakdown | Read |
|---|---|---|---|
| [IC3 Internet Crime Report 2024 (PDF)](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf) | 83 % | US | 2026-10-12 |
| [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) | 65 % | medium | 2026-10-12 |
| [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) | 43 % | GB | 2026-10-12 |
| [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) | 38 % | phishing | 2026-10-12 |
| [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) | 12 % | impersonation | 2026-10-12 |
| [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) | 1 % | ransomware | 2026-10-12 |

## The sentence each figure was read from (6)

- [IC3 Internet Crime Report 2024 (PDF)](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf), read 2026-10-12: "Cyber-enabled fraud is responsible for almost 83% of all losses"
- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), read 2026-10-12: "Following the pattern observed in previous years, medium (65%) and large (69%) businesses were more likely to have experienced a cyber breach or attack in the last 12 months compared to micro (42%) and small (46%) businesses."
- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), read 2026-10-12: "Just over four in ten businesses (43%) and around three in ten charities (28%) reported having experienced any kind of cyber security breach or attack in the last 12 months."
- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), read 2026-10-12: "Phishing attacks remained the most prevalent type of breach or attack by far (experienced by 38% of businesses and 25% of charities) and continued to be ascribed as the most disruptive type of breach or attack (69% of businesses and charities that experienced a breach or attack)."
- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), read 2026-10-12: "Impersonation breaches or attacks have decreased to 12% this year, down from 17% in 2023."
- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), read 2026-10-12: "Ransomware attacks among businesses have declined compared with the previous two years (1% this year down from 3% in both 2024/2025 and 2023/2024) and phishing attacks and impersonation breaches or attacks, whilst not significantly different to last year, have significantly declined compared to two years ago (38% this year down from 42% in 2023/2024)."

## Read in full, publishes no figure

- [DSIT Cyber Security Breaches Survey: release page](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026), read 2026-10-12: read in full and no accepted figure on the page
- [FBI IC3 Internet Crime Report index](https://www.ic3.gov/AnnualReport/Reports), read 2026-10-11: read in full and no accepted figure on the page
- [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025), read 2026-10-12: read in full and no accepted figure on the page
- [ENISA threat landscape topic](https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape), read 2026-10-12: every candidate on the page was refused
- [FTC small business cybersecurity](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity), read 2026-09-12: read in full and no accepted figure on the page

## Methodology

Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 7 named sources that could be read published a usable figure; 5 published none and are recorded as not published, never filled in; 1 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in % (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 6 figures, never sentences; 23 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one series per jurisdiction per year from the official statistics only - incidence, attack type mix and the reported cost distribution (median and quartiles, never a mean, because the tail is what a mean hides) - joined across UK, US and EU releases so the same year reads three ways; against it the annual cost of the managed-security tier from the pricing index, which turns 'is it worth it' into a number rather than an argument.

## Sources

- [DSIT Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) (the publisher's own terms; quoted for reporting and comment)
- [DSIT Cyber Security Breaches Survey: release page](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026) (the publisher's own terms; quoted for reporting and comment)
- [FBI IC3 Internet Crime Report index](https://www.ic3.gov/AnnualReport/Reports) (the publisher's own terms; quoted for reporting and comment)
- [ENISA Threat Landscape 2025](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2025) (the publisher's own terms; quoted for reporting and comment)
- [ENISA threat landscape topic](https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape) (the publisher's own terms; quoted for reporting and comment)
- [FTC small business cybersecurity](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity) (the publisher's own terms; quoted for reporting and comment)
- [CISA cybersecurity advisories](https://www.cisa.gov/news-events/cybersecurity-advisories) (the publisher's own terms; quoted for reporting and comment)
- [IC3 Internet Crime Report 2024 (PDF)](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf) (the publisher's own terms; quoted for reporting and comment)

## Cite or embed

- The Cyber Incident Cost carries 6 published figures read from 2 sources' own pages; the 3 published figures given by attack type run from 1 to 38 percent, read 12 October 2026.
- 2 of the 7 named sources read in full publish a figure; 5 publish none, read 12 October 2026.
- Cyber Incident Cost, jurisdiction GB: median 43 percent across 1 source, read 12 October 2026.
- Cyber Incident Cost, jurisdiction US: median 83 percent across 1 source, read 12 October 2026.
- Cyber Incident Cost, business size medium: median 65 percent across 1 source, read 12 October 2026.
- Cyber Incident Cost, attack type phishing: median 38 percent across 1 source, read 12 October 2026.
- Cyber Incident Cost, attack type ransomware: median 1 percent across 1 source, read 12 October 2026.
- Cyber Incident Cost, attack type impersonation: median 12 percent across 1 source, read 12 October 2026.

Cite as: "Outsourced IT Quotes Cyber Incident Cost", updated 2026-10-19, https://outsourceditsupportquotes.com/datasets/cyber-incident-cost/.

CSV: https://outsourceditsupportquotes.com/datasets/cyber-incident-cost.csv
JSON: https://outsourceditsupportquotes.com/datasets/cyber-incident-cost.json
Embed (plain HTML, static link back): see https://outsourceditsupportquotes.com/datasets/cyber-incident-cost/#median