A government press release claims a cyber attack could cost a UK business £195,000 on average. Its own footnote admits that figure comes from US data and a sample of eighteen firms.
Estimated reading time: 6 minutes
In short. DCMS's 3 November 2026 release, "New Government-backed cyber security protections could save UK businesses thousands," opens with a warning that "a significant cyber-attack on a UK business or organisation could cost on average £195,000" [[1]]. A footnote to that same sentence says the figure is "based on data from primarily US disclosures," scaled up using UK attack rates, and that for medium and large firms it rests on "a limited sample size of 18" which "should therefore be interpreted as indicative only" [[1]]. The department's own Cyber Security Breaches Survey 2025/2026, co-published five months earlier, asked UK organisations directly and found a median cost of £0 for all businesses, rising to just £30 for medium and large businesses, from a UK sample of 272 [[2]]. Second finding: the release's funded support, a discount for about 6,000 businesses and a free grant route for about 8,000 more, reaches roughly 14,000 businesses against 5.68 million UK SMEs and the 612,000 the department's own survey says were breached in the last year [[2]][[3]]. Two documented mistakes: four stars.
Cyber security for small businesses is not a small market. DCMS says 230 organisations have signed its Cyber Resilience Pledge and estimates £2.4 million will fund roughly 6,000 Cyber Essentials discounts, with a further £7 million funding free certification for about 8,000 supply-chain firms by March 2029 [[1]]. Woven through the announcement is a single cost figure, repeated as the reason any of this matters: a cyber attack could cost a UK business £195,000. The department wrote the number itself. It also wrote, in the same release, the reason not to trust it.
The claims, tested
| The release's own words | What the department's own survey shows | Verdict |
|---|---|---|
| "Recent estimates suggest a significant cyber-attack on a UK business or organisation could cost on average £195,000" [[1]] | Footnote 1, same release: "Due to lack of available UK-based cost data, the estimate is based on data from primarily US disclosures... for medium and large firms this estimate is based on a limited sample size of 18 and should therefore be interpreted as indicative only" [[1]] | A headline figure the document's own sourcing note calls indicative, built from a foreign dataset too thin to carry the claim |
| The £195,000 estimate is "scaled up by the estimated number of firms affected by cyber attacks obtained from the CSBS" [[1]] | The CSBS itself, published by the same department five months earlier, separately asked UK organisations what their most disruptive breach actually cost: median £0 for all businesses, £30 for medium/large, rising to £4,000 and £10,000 only at the top 5% of cases, from a UK base of 952 businesses (272 medium/large) [[2]] | The department borrowed the CSBS's attack-frequency data but not its UK-specific cost data, which exists, is larger, and tells a different story |
| "Thousands of small and medium-sized business owners across the UK can now take advantage of" the discount and grant schemes [[1]] | Government's own funding estimates: roughly 6,000 businesses via the discount (first come, first served, to March 2027) and roughly 8,000 via the supplier grant (to March 2029), around 14,000 in total [[1]], against 5,681,930 UK SMEs [[3]] and the 612,000 businesses the department's own survey says identified a breach or attack in the last 12 months [[2]] | A funded reach of roughly 0.25% of UK SMEs, and about 2% of the businesses the department's own data says were actually attacked this year |
One department, two cost figures
The £195,000 claim is not unsourced. It carries its own footnote, which is more candid than the headline it supports: "Due to lack of available UK-based cost data, the estimate is based on data from primarily US disclosures. The underlying assumption is that average costs for US-based organisations can be compared to the average costs in the UK" [[1]]. The attack-frequency weighting comes from the Cyber Security Breaches Survey (CSBS), the department's own annual research; the cost-per-attack figure does not, because the footnote says UK cost data was not available for the estimate.
That is not quite true. The CSBS itself, co-published by DCMS and the then Department for Science, Innovation and Technology on 30 April 2026, devotes a full section, 4.6, to exactly this question: "Each year, this survey series has attempted to capture the perceived cost of cyber security breaches or attacks on organisations" [[2]]. Its answer, drawn from UK fieldwork rather than American disclosures, is a median cost of £0 for all businesses and charities, rising only to £30 when the sample is narrowed to medium and large businesses alone, with the explanatory text noting that "a median cost of £0 reflects that many organisations reported having no experience of direct financial loss, not that harms are negligible" [[2]]. Even at the sharp end, the top 5% of cases, the CSBS puts the cost at £4,000 for most businesses and £10,000 for medium/large ones [[2]], a long way short of £195,000. The medium/large figure in Table 4.1a rests on a UK base of 272 organisations [[2]], fifteen times the sample of 18 the press release's own footnote says its US-derived figure depends on.
Two numbers from the same department, five months apart, measuring the same thing, eighty to four thousand times apart depending which percentile is used. The press release's text carries none of that context; a reader has to follow the footnote, then separately know the CSBS exists, to find it.
Thousands of businesses, a much smaller thousands
The release's opening claim is that "thousands of small and medium-sized business owners across the UK can now take advantage of" the new discount [[1]]. That is true in the narrowest sense: its own Notes to editors section estimates "approximately 6,000 new businesses could benefit" from the £2.4 million Cyber Essentials First Step Fund, allocated "on a first comes first served basis" until March 2027 or until the money runs out, plus "approximately 8000 businesses" from the separate £7 million supplier grant, open only to firms nominated by one of the 230 Cyber Resilience Pledge signatories [[1]].
Against the UK's 5,681,930 SMEs, as counted in the government's own Business Population Estimates for 2025 [[3]], roughly 14,000 funded places is a rounding error. Measured against the department's own CSBS finding that 612,000 UK businesses identified a breach or attack in the last 12 months [[2]], the two schemes between them could fund first-time certification for about one in forty of this year's affected businesses, assuming none of them had been certified in the last four years and every funded place went to a business that was actually attacked, which the eligibility rules do not require. "Thousands of businesses" is accurate; it is also language that does not distinguish a scheme reaching 14,000 firms from one reaching 1.4 million.
Credit where due
The footnote itself is the most honest part of the release: a government press office that wanted to bury the weakness of its own headline number would not have written "should therefore be interpreted as indicative only" into the text at all [[1]]. The underlying schemes are also real and narrowly well-targeted: a 75% discount that drops Cyber Essentials certification to £80 to £125 plus VAT roughly matches the standard £320-plus starting price NCSC's own certification body advertises, and the supplier-grant route, aimed at SMEs sitting inside the supply chains of 230 larger pledged organisations, is a sensible way to spend a smaller budget on businesses a major breach would hit hardest. The problem is not the arithmetic behind the schemes. It is the gap between a footnoted, UK-sourced acknowledgement of a figure's weakness and a headline that states it as settled fact.
The star score counts two documented mistakes. First, the release's headline cost claim, a cyber attack could cost a UK business £195,000 on average, is sourced by its own footnote to primarily US disclosure data and a sample of 18 medium/large firms, while the department's own Cyber Security Breaches Survey 2025/2026, published five months earlier from a UK sample of 952 businesses, found a median cost of £0 to £30 and a 95th-percentile cost of £4,000 to £10,000. Second, the release's framing of "thousands of small and medium-sized business owners" able to benefit covers roughly 14,000 funded places against 5.68 million UK SMEs and the 612,000 businesses the same department's survey says were breached in the last year. This piece finds no wrongdoing by DCMS, the NCSC or any named individual; Cyber Security Minister Liz Lloyd is quoted only in her ministerial capacity, from the department's own published release. All sources were fetched directly on 3 November 2026 and returned HTTP 200.
Sources
- New Government-backed cyber security protections could save UK businesses thousands, Department for Digital, Culture, Media and Sport, published 3 November 2026.
- Cyber security breaches survey 2025/2026, Department for Digital, Culture, Media & Sport and Department for Science, Innovation and Technology, published 30 April 2026.
- Business population estimates for the UK and regions 2025: statistical release, Department for Business and Trade, published 2 October 2025.