The past few weeks have been interesting if you follow UK business news. TFG London, Phase Eight, Hobbs and Whistles, confirmed a cyberattack that knocked out IT systems across its stores. ASOS discovered an intrusion after hackers used its own app to push notifications to customers. And H&M is investigating claims from the group ShinyHunters. These follow a run of high profile UK attacks over the past year, including Marks & Spencer, Co-op, Harrods and Jaguar Land Rover, whose hack reportedly cost the business around £2 billion and disrupted roughly 5,000 other organisations in its supply chain.
It's tempting to read these as a "big business" problem, but the government's latest Cyber Security Breaches Survey found that 43% of UK businesses experienced a cyber breach or attack in the past 12 months, including 46% of small businesses and 42% of micro businesses. Nearly a third of those affected said they are targeted at least once a week, and phishing remains the most common route in, affecting 38% of businesses. Smaller firms are often how attackers reach larger ones further down the supply chain, as the Jaguar Land Rover incident showed only too well.
You do not need a security team or a big budget to make a real difference to the strength of your cyber security:
→ Turn on multi-factor authentication across your email, banking and any system holding customer data. This single step blocks the vast majority of account takeover attempts, and most providers can switch it on in minutes.None of this requires specialist knowledge, and all of it can be done without buying anything new. That is what makes it a genuine quick win, and a useful one to repeat every few months as your team and systems change.
Good habits reduce your risk, but they cannot remove it entirely. Even well-prepared businesses get caught out, and the cost of an attack reaches well beyond any ransom demand - incident response, legal advice, lost revenue while systems are down, and in some cases regulatory fines and the cost of notifying affected customers. That is where cyber insurance comes in alongside your other safeguards.
A 2024 government survey puts the average cost of a business's most disruptive breach or attack at £1,600 to £3,550. That figure covers things like technical clean-up and lost productivity, but it is before any ransom demand, specialist legal advice, or the revenue a business loses while its website or systems are offline, which is often where the real damage sits. For a small or micro business without a dedicated budget to absorb a hit like that, the consequences can be more severe.
Not all cyber policies are built the same, so it is worth knowing what you are actually covered for. A solid policy should cover data breach response, the cost of investigating an incident and notifying everyone affected. It should also cover liability, so you are protected if a breach leads to legal action from customers or partners, and data restoration, to help you recover information that has been lost, corrupted or encrypted.
Ransomware and cyber extortion cover matter too. Attackers increasingly threaten to publish stolen data, and a policy that only pays out for a classic ransom demand can leave you exposed to that newer tactic. Business interruption cover is just as important. If an attack takes your systems offline for days, as happened to TFG London and Jaguar Land Rover, the lost income can make the cost of fixing the technical problem seem small in comparison.
Good cyber cover also gives you access to incident response specialists from the moment you report a breach, meaning there are people who can assess what has happened, isolate affected systems, and get you back up and running, rather than leaving you to work it out alone.
If you are not sure whether your current cover would respond to an incident like the ones making headlines, now is a good time to check. Take a look at our cyber insurance cover or get in touch for a free sense-check of your current cover and how it might respond.
Disclaimer: This content has been produced for general information purposes and should not be taken as formal advice. You should always seek specific professional advice before acting on any of the information given.