Question to the HM Treasury:

To ask the Chancellor of the Exchequer, what estimate she has made of the cost of cyber attacks on UK-based businesses in the last 12 months.

An increasingly hostile cyber threat poses a risk to the UK economy and public finances. According to the Office for National Statistics, the decline in the manufacture of motor vehicles, observed in the wake of the cyber attack on Jaguar Land Rover, reduced September’s GDP by 0.17%. In the 2022 Fiscal Risks and Sustainability report, the Office for Budget Responsibility estimated that a cyber-attack on critical national infrastructure could temporarily increase borrowing by around £30 billion – equivalent to 1.1% of GDP.

Cyber-attacks have significant costs for UK businesses. Recent KPMG modelling for the Department for Science, Innovation and Technology suggests the average cost of a significant cyber-attack for an individual business in the UK is around £194,729. KPMG estimate this could represent a total yearly cost to businesses in the UK of £14.7 billion, representing 0.5% of the UK’s annual GDP.

The government is committed to strengthening cyber security across the UK. The National Cyber Security Centre (NCSC) provides a range of tools, guidance and support to businesses to improve their cyber security. At last year's Spending Review, the government increased the Single Intelligence Account's budget by £1 billion over the SR period, which funds the critical cybersecurity work conducted by NCSC.

The UK’s cyber resilience relies on all businesses playing their part. The Chancellor of the Exchequer; Secretary of State for Science, Innovation and Technology; Secretary of State for Business and Trade; Minister for Security; CEO of the National Cyber Security Centre and Director General of the National Crime Agency wrote to chief executives and chairs of FTSE 350 companies in October 2025 year asking them to make cyber security a top priority.