GRC

ICO logs record 1,371 cyber breach reports in a single quarter

Cyber breach reports to the ICO hit a record 1,371 in Q3 2026, yet ransomware reports keep falling as UK leak-site listings rise.

Bar chart motif with the headline Record cyber breach reports reach the ICO

UK organisations reported 1,371 cyber incidents to the ICO, the UK data protection regulator, between July and September 2026, beating the previous quarterly high. Ransomware reports to the ICO, though, keep falling while extortion gangs name more British victims, and that gap deserves a hard look from every compliance team.

What happened

The ICO’s data security incident trends dashboard was updated on 26 October 2026 with figures for Q3 2026. Recorded Future News analysed the release and reported on 13 November that Q3 brought 1,371 breach reports the regulator classes as cyber incidents. That beats the previous quarterly peak, set in 2023, and leaves 2026 on course to overtake the 2023 annual total. Counting non-cyber breaches as well, such as misdirected emails and lost paperwork, the ICO received 4,604 reports in the quarter, also a record.

The increase was spread across several sectors. Between Q2 and Q3, retail and manufacturing reports rose from 205 to 296, roughly 44 per cent. Charities and voluntary organisations went from 79 to 145, close to double. Online technology and telecoms climbed from 76 to 120. Of the six sectors with the most reports, only education and childcare fell, from 135 to 115.

Very few of these reports turn into formal action. According to The Record’s figures, the ICO opened investigations into 18 of the 1,371 cyber cases, about 1.3 per cent, and closed most of the rest with informal action. The figures remain provisional.

The detail

The dashboard has real limits, and the ICO states them openly. It covers only breaches that organisations found and then chose to report under Article 33 of UK GDPR, which requires notification within 72 hours of becoming aware of a reportable breach. The ICO assigns categories on a best-fit basis and says its cyber versus non-cyber split is under review. Some of the larger and more serious cases go to a separate system and do not appear in the published data at all. Most new cyber reports fall into the catch-all “other cyber incident” category, which reveals little about the attacks themselves.

The ransomware numbers stand out. Reports filed under ransomware have dropped every year: 1,253 in 2023, then 752 and 620 in the two years after. In the first nine months of 2026 there were 321, with 102 in Q3 against 111 in Q2.

Threat intelligence points the other way. Sophos told The Record that about 350 UK organisations had been named on extortion leak sites so far this year, roughly a 50 per cent rise on last year and well ahead of a global increase nearer 25 per cent. Sophos’s Rafe Pilling called leak-site counts an “imperfect metric”, but said they still showed extortion rising, particularly in Britain. CYFIRMA’s October tracker logged 1,178 publicly claimed victims worldwide that month, its highest total since it began tracking, with Qilin, The Gentlemen and N0n accounting for 39 per cent of claims.

Key figures from ICO Q3 2026 breach data: 1,371 cyber reports, 4,604 total incidents, 18 investigations, falling ransomware reports and rising UK leak-site listings

Why it matters for UK organisations

The two trends could both be accurate. The likeliest explanation is that extortion incidents are being reported but recorded under a different label. Many current groups steal data and skip encryption altogether, and the ICO has not said whether a pure data-theft extortion case goes under ransomware or under “other cyber incident”. If it goes under “other”, the record headline figure may be where the missing ransomware cases are.

The other explanation is genuine under-reporting, and it carries more legal risk. Article 33 is not optional. If personal data has been stolen or made unavailable, the controller must notify unless the breach is unlikely to result in a risk to individuals, and must document its reasoning either way. A company that pays quietly, or decides without proper analysis that stolen files held “nothing personal”, is taking a regulatory gamble. Bridewell’s analysis of enforcement records suggests the ICO now issues fewer, larger fines, with accountability weighing heavily on their size, so an organisation that never notified will be badly placed once its data appears on a leak site.

The reporting landscape is also getting tighter. The government’s response to its ransomware consultation says work will continue on a targeted payment ban for public sector bodies and regulated critical national infrastructure, a payment prevention regime and mandatory ransomware incident reporting, with a 72-hour initial window still under consideration. The Cyber Security and Resilience Bill, which completed Lords Report Stage on 26 October and then goes back to the Commons for MPs to consider peers’ amendments, will bring managed service providers and large data centres into scope and oblige some providers to keep affected customers updated after a reportable incident. One incident may soon mean several notifications, each with its own clock.

Expert view

In my experience, the ICO notification decision is one of the most rushed in incident response. Technical staff are busy containing the attack, lawyers are waiting for facts, and nobody owns the question of whether personal data was taken. When we test incident response plans, the regulatory notification step is often one line naming a role, with no decision criteria, no evidence template and no backup if that person is unavailable.

The rise in charity reports also stands out. Charities often hold sensitive data about vulnerable people on thin security budgets, sometimes with volunteers running IT. A near doubling in one quarter suggests attackers see the sector as soft.

The 18 investigations should not reassure anyone. A low investigation rate is a triage decision by a regulator with limited resources, not a sign of tolerance. Formal attention tends to fall where basic controls were missing. Pilling’s advice, fixing internet-facing vulnerabilities and moving to phishing-resistant MFA, matches what I see go wrong time after time.

What to do now

  1. Write down your Article 33 decision process. Set out who decides, which criteria they apply and how the decision is recorded, including decisions not to notify. Test it in your next tabletop exercise.
  2. Assume exfiltration in any extortion event. Treat a ransom demand or a leak-site listing as a likely personal data breach until forensic evidence shows otherwise, and start the 72-hour clock from that point.
  3. Map every reporting duty you have. Combine ICO, sector regulator, NIS, contractual and cyber insurance notification duties in a single matrix, and keep an eye on the ransomware reporting proposals and the CSR Bill.
  4. Close the edge. Patch internet-facing VPNs, firewalls and backup consoles quickly, and keep the device inventory current. This maps to the Cyber Essentials firewall, secure configuration and security update management controls.
  5. Enforce phishing-resistant MFA. Prioritise remote access, administrator accounts and cloud consoles, in line with Cyber Essentials user access control.
  6. Protect your ability to recover. Keep at least one immutable, tested backup and isolate backup and hypervisor administration from ordinary user networks.
  7. Reduce what can be stolen. Enforce retention schedules and delete data you no longer need.

Bottom line

Record cyber breach reports to the ICO show that the pressure on UK organisations is real and widespread. Falling ransomware figures alongside rising leak-site listings show that the official picture is incomplete, whether through categorisation or through organisations staying quiet. Boards should make sure their own notification decisions are prompt and defensible, because a stolen dataset tends to surface eventually.

Sources

Related Posts