UK businesses are buckling under the threat of cyber-attack with over half having fallen victim in the past 12 months.

Insurance group Hiscox published its ninth annual Hiscox Cyber Readiness Report, highlighting the level of cyber risk facing SMEs. More than half of respondents (59%) said they had experienced a cyber-attack in the last 12 months. A third of those (33%) faced a substantial fine in the aftermath of a data breach – significant enough to impact the financial health of their business.

The ripple effect of a cyber-attack is significant: 30% of respondents reported a reduction in business performance indicators, such as share price; 29% incurred increased costs associated with notifying affected customers; and 29% found it hard to attract new business following an attack. The fall-out doesn’t end there: 44% were out of pocket as a result of payment diversion fraud, and 32% said employees had struggled with burnout following an attack.

Eddie Lamb, global head of cyber at Hiscox, commented: “No business, however small, can afford to underestimate the devastating impact a cyber-attack can have. Cyber-attacks don’t just disrupt day-to-day operations; they can threaten the very survival of a business. The financial fall-out, from crippling fines to lost customers or soaring costs, can push even the most resilient business to the brink. On top of this, the stress and long hours required to recover can impact staff morale and even lead to burnout.”

Ransomware remains a major threat, with 27% of businesses surveyed reporting an attack in the past year. Of those affected, 80% – which includes both insured and uninsured businesses – paid a ransom in an attempt to recover or protect critical data. However, only 60% successfully recovered all or part of their data as a result, and for almost a third (31%) of those who paid a ransom, the attackers demanded more money.

As a number of governments, including the UK continue to consider legal changes or reporting requirements to the payment of ransoms for cyber-attacks, 71% of those surveyed believe companies should be required to disclose ransom payments in the fight against cyber-crime.

Lamb added: “There’s no doubt that ransomware tactics are shifting and for uninsured businesses without the expertise of a cyber insurer this leaves them significantly exposed. Cyber criminals are now much more focused on stealing sensitive business data – things like contracts, executive emails, financials, and intellectual property – because it’s easier to monetise than personal information. Once stolen, they demand payment to avoid public exposure, pricing threats based on reputational damage. This change has exposed gaps in some companies’ data loss prevention controls, which attackers are readily exploiting.”

While nearly two-thirds (65%) of respondents felt AI was more of an asset than a vulnerability, over half (57%) admitted to having been hit by at least one attack as a result of an AI-related vulnerability. Emerging AI-driven threats include AI social engineering attacks, the use of deepfakes, vulnerabilities in third party AI tools, and AI breaking access controls to company data leading to unintended disclosure.

In response, SMEs are stepping up their cyber defences, with 94% planning to boost their investment in cyber security over the next 12 months, 70% extending the cyber training they provide to employees, and 60% hiring additional staff to increase cyber resilience.

Commenting on the report Rob Demain, CEO of e2e-assure said: “Hiscox’s Cyber Readiness report reveals that up to 80% of firms that have experienced a ransomware attack have paid up. When seeing the devastating fallout from attacks like the one against Jaguar Land Rover, organisations may feel forced to negotiate with the attackers to avoid the downtime and loss of data. Yet this only shifts the cost, often exacerbating recovery expenses while fuelling further attacks.

“Strengthening cyber resilience must therefore be treated not as a discretionary cost or a compliance exercise, but as a matter of national economic stability. Investment in security should be integrated into existing systems and harness automation to shorten detection and response times. The faster attacks are contained, the less damaging the consequences due to the reduced cost and downtime, strengthening an organisation’s ability to restore normal operations.

“Cyber resilience is no longer a technical issue; it is an economic imperative.”