On 30 June 2026, the City of London Police published ransomware figures that should make any UK IT manager sit up. In the 12 months to March 2026, 323 organisations reported a ransomware attack — more than 26 a month. Average financial losses per incident rose 50% year-on-year to £270,000. Over half the victims were SMBs.
That last point matters. Ransomware is not just a problem for large enterprises with complex environments and deep pockets. It is landing on mid-sized businesses, smaller companies, and organisations with lean IT teams every single week.
Most businesses are no longer paying the ransom — but that doesn't mean recovery is cheap
There has been a meaningful shift in how businesses respond when they are hit. The UK ransom payment rate dropped from 44% in 2023 to just 17% in 2025/26. That is a good trend. Paying a ransom funds criminal activity, rarely guarantees full data recovery, and does nothing to fix the underlying security problem.
But refusing to pay does not mean walking away unscathed. Recovery from backups still carries a substantial cost — one that many businesses underestimate until they are in the middle of it.
Think about what is actually involved when you try to recover from a ransomware incident:
- Forensic investigation to understand what happened, what was accessed, and what was taken
- System rebuilds because you cannot always trust that an infected environment is clean
- Data integrity verification — restoring from backup is one thing; confirming the restored data is complete and uncorrupted is another
- ICO notification if personal data was involved, which in most cases it will have been
- Staff downtime while systems are offline or degraded
- Customer notification if their data was exposed
Even when no ransom is paid, the total cost of an incident can easily reach six figures. The £270,000 average almost certainly understates reality — many businesses do not fully disclose their financial damage, and indirect costs like lost revenue, reputational harm, and staff time rarely make it into the reported figures.
Having a backup is not the same as being protected
Here is the uncomfortable part for many IT teams. The assumption that "we have a backup, so we're fine" is no longer a safe one to hold.
Ransomware operators know that backups are the main route to avoiding payment. As a result, 96% of ransomware attacks now actively target backup repositories. Of those attacks, 76% successfully compromise the backups they target.
That means for a significant proportion of organisations that get hit, their backups are either encrypted, deleted, or corrupted alongside the primary data. They discover this at exactly the worst moment — when they need to restore.
The data is clear on what this means in practice. Organisations with intact, tested backups face a median recovery cost roughly eight times lower than those whose backups were compromised. The quality of the backup determines the cost of the recovery. A backup that has not been tested and is not isolated from the main environment is not really a backup — it is a liability waiting to be discovered.
The ICO sits on top of all of this
A ransomware incident that touches personal data — employee records, customer information, financial data — is not just an IT problem. It is a regulatory one.
The ICO has sharpened its enforcement focus on exactly this area. UK GDPR Article 32 requires organisations to have appropriate technical measures to protect personal data. When a cyberattack exposes that data, the ICO will want to know what those measures were and whether they were adequate. Recent enforcement action — including fines totalling £15 million against organisations whose cyberattack-related breaches demonstrated security failures — makes clear that this is not a theoretical risk.
Add potential ICO fines to the forensic costs, the rebuild costs, the staff downtime, and the reputational damage, and the £270,000 average starts to look less like an outlier and more like a floor.
What you can actually do about it
Only 25% of UK businesses have a formal incident response plan in place. That means the majority of organisations that experience a breach are reacting without a defined strategy — working it out as they go, under pressure, with systems down and staff in panic.
The practical priorities for any SMB or mid-market IT team right now are straightforward:
- Know whether your backups are isolated. If ransomware can reach your backup environment from your primary environment, your backups are at risk. Immutable, offsite, or air-gapped backups are not optional extras.
- Test your restores. A backup you have never restored from is a backup you do not actually have. Test it regularly, document it, and make sure more than one person knows how it works.
- Have a recovery plan before you need one. Who does what when an attack lands at 2am on a Friday? If you cannot answer that quickly, the plan needs writing.
These are not complex things. But they require someone to own them — and for most SMBs, that means either having the internal resource to do it properly or having a managed service that does it for you.
IronFell provides managed backup and data protection for UK businesses — tested restores, isolated environments, and a clear recovery process built before anything goes wrong. If you want to know whether your backups would actually hold up, get in touch with IronFell today. No jargon, no hard sell.
Protect your business data.
Get a real, itemised quote in under 5 minutes — no sales calls.
Start protecting your data