Record number of cyber incidents reported to UK privacy regulator

British organizations reported a record number of cyber incidents to the country’s data protection regulator over the summer, according to official figures analyzed by Recorded Future News.

The surge comes as industry sources describe dealing with a swelling number of cases in which U.K. entities are being named on data leak sites, used by cybercriminals to extort their victims.

Staff at some firms have said they are turning away clients because of the demand for their services. A similar trend reported by NBC News attributed the increase to attacks using artificial intelligence.

According to the data, Britain’s Information Commissioner’s Office (ICO) recorded 1,371 cyber incidents between July and September this year, beating a previous high for any three-month period set in 2023.

It also means Britain is set to surpass its previous annual record, also set in 2023, when the ICO called on organizations to do more to combat the growing threat of cyberattacks.

In total, reports of all data security incidents — including non-cyber breaches such as emails sent to the wrong recipient — also reached a quarterly high of 4,604.

The ICO has published its security incident data for several years, but the figures remain little-known and are rarely reflected by official government communications.

Although the data is limited — it captures only incidents that organizations discover and report to the regulator — experts describe it as the best yardstick available of actual incident counts.

The latest figures are provisional, with dozens of cases still awaiting an outcome, but such provisional figures rarely stray far from the final confirmed count.

The nature of the new attacks is also unknown. The ICO classifies the majority of them as other cyber incidents, a catch-all category distinct from phishing, ransomware and malware.

Even as industry sources describe extortion attacks as on the rise, the ICO data shows ransomware reports are generally falling. It is unclear if the ICO data limits its ransomware category to encryption attacks or includes data extortion as well.

The regulator recorded 1,253 ransomware incidents in 2023, falling to 752 in 2024 and 620 in 2025. Just 321 were reported in the first nine months of 2026, including 102 in the third quarter, down from 111 in the second.

Data on attempted extortions — collected from the leak sites where ransomware gangs publicly name their victims — points to an increase in these incidents.

Rafe Pilling, director of threat intelligence at Sophos, cautioned that leak-site data are an “imperfect metric” but said they suggest ransomware and data-theft extortion are increasing, particularly in Britain.

Sophos observed criminal groups naming more than 1,200 new victims worldwide in October, which the company said is the highest monthly total the company has recorded and nearly two-thirds more than a year earlier.

Pilling said the surge was driven chiefly by the Qilin, The Gentlemen and n0n groups, alongside several smaller operations which appear to have emerged only recently.

About 350 British organizations have been named on leak sites so far this year, he said, an increase of roughly 50% from last year — a count substantially above the global average rise of closer to 25%.

“Globally, this is a recent surge. In the UK it has been a steady climb all year,” Pilling said, adding that Sophos saw November as already on course to exceed the year’s monthly average.

Several employees at British incident response firms have told Recorded Future News they were turning away clients amid a surge in demand.

Others described heavy workloads but said they were not overwhelmed. They noted that incident response firms routinely balance keeping specialists occupied with maintaining spare capacity to handle sudden increases in attacks.

The rise in reports to the ICO was spread across several sectors, with retail and manufacturing recording the most incidents — rising from 205 in the second quarter to 296 in the third — as reports involving charities and voluntary organizations nearly doubled, from 79 to 145.

Online technology and telecommunications companies also reported an increase from 76 to 120. The education and childcare sector was the only one of the six most-affected to record a decline, from 135 to 115.

To date, few of the reports received by the ICO have led to formal regulatory investigations. The regulator says it pursued investigations in just 18 of the 1,371 cyber incidents reported in the third quarter, with most of the cases closed with informal action.

Recorded Future News previously found that the regulator was investigating fewer ransomware incidents even as reports increased.

Pilling said several factors were contributing to the broader threat, including established cybercriminal groups incorporating artificial intelligence into their operations, and a growing number of attacks involving AI agent frameworks.

But he said basic security measures could still prevent many of the most successful attacks. Fixing vulnerabilities in systems exposed to the internet and deploying phishing-resistant multifactor authentication and passkeys would go a long way toward reducing the risk, he said.

The ICO and the National Cyber Security Centre did not immediately respond to a request for comment.