Let’s start with something most security companies won’t tell you. In the UK Government’s latest survey, the median direct cost of a micro or small business’s worst breach was £0.
What the survey says
The Cyber Security Breaches Survey 2025/26 is the Government’s official survey of more than 2,000 UK businesses, published in April 2026.
42% and 46%
The share of micro and small businesses that identified a breach or attack in the last 12 months. This includes attempts that didn’t get through, and most were phishing.
£0, or £560
The median cost of the most disruptive breach for micro and small firms was £0 across all who identified one, and £560 among those where something actually happened.
£4,000, or £14,440
The top 5% of costs, on the same two measures. So a small number of incidents cost far more than the typical one.
21%
The share of micro businesses with a formal incident response plan. Most would be working it out on the day.
The survey cautions that a £0 median “reflects that many organisations reported having no experience of direct financial loss, not that harms are negligible.” It’s also about all kinds of cyber incidents, mostly phishing emails. It doesn’t look at home-built apps, and we know of no good UK figure that does.
You may also see £195,000 quoted, from a Government press release. Its own footnote says that’s based on mainly US data and a limited sample for medium and large firms, so it isn’t a useful guide for a small business.
Where the real costs are
If you depend on a home-grown system, the invoice is rarely the part that hurts.
Your time, at the worst moment
Working out what happened, what was exposed and who needs telling, while still running the business. If only one person understands the system, it all falls on them, assuming they’re available.
The customer conversation
If there’s a high risk to the people affected, you have to tell them. Writing to your customers to say that their details were open to anyone is hard, particularly if a competitor could also have seen your prices.
Your customer list and prices
The most likely loss for many small firms isn’t ransom. It’s that someone could quietly read who your customers are and what they pay, which won’t show on any survey.
Bad data and lost days
If records have been changed or deleted, you need a working backup. Fewer micro businesses are recovering within a day, down to 86% from 92% the previous year. And if nobody has ever tried restoring a backup, you may find out the hard way whether it works.
Bigger customers and buyers
Larger customers increasingly ask about security before they sign. A buyer’s due diligence will ask how your systems are looked after. A known incident, or just having no good answers, can cost more than the incident did.
What about fines?
The headline maximums under UK GDPR are £17.5 million or 4% of worldwide turnover, and £8.7 million or 2% for some breaches. Those are ceilings, and the ICO takes your size and turnover into account. We’d rather be straight with you: we found no ICO fine against a small commercial company over a flaw in its own software, though we didn’t review every enforcement record. The ICO says that “not every breach reported to us results in formal action”, and that its main aim is to provide advice.
That doesn’t mean it can’t happen. Small charities have been fined for simple failures: Central YMCA £7,500 for an email sent with CC in place of BCC, and Birthlink £18,000 for destroying records. If anyone tells you you’ll be fined millions, treat the rest of what they say with caution as well. Your actual duties are explained in UK GDPR and your app.
What’s worth spending
Most of the protection available costs little or nothing: two-step sign-in, removing old accounts, tested backups, and someone else who can sign in. The Government’s Cyber Essentials scheme costs less than it did, too. An audit is worth having when your app holds personal data or your business can’t run without it, because those are the situations where the unusual, expensive outcomes matter.
Sources
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
