With businesses facing huge threats from continued cyber security threats, over half of businesses report some form of attack in the past 12 months. And while some sectors take it seriously - investing in training, resources and insurance - others tend to let it slip by.
Businesses in the communication sector tend to treat cyber security as a higher priority than any other, with 65% saying it is a “very” high priority. While finance and health trail behind in the top five. But has this translated into a reduction in attacks? According to the ICO, no. The number of cyber security incident reports increased by 6% across all sectors - up to almost 9,000.
Back in 2022, 91% of UK companies responding to their survey stated they had experienced at least one successful email-based phishing attack in 2022.
Malware was the second most commonly reported incident with 362, compared to 395 in 2023. However, that was an 8% drop compared to 2023. This trend continues for all other cyber incidents as they all saw a decrease in successful attacks.
Ransomware was the third most reported incident of 2024, with businesses noting a 13% overall decrease in attacks. There were 3,011 cases reported last year, but a huge 3,460 in the year before.
Brute force takes fourth with a 32% decrease in reports - noting 212 in 2024 and 311 in 2023. Unauthorized access saw a 45% decrease with 177 reports in 2024 down from 323 in 2023. Denial of service is sixth with an 83% decrease in 2024 reports down to 1 from 6 in 2023.
With an additional 76 reports in the first three quarters of 2024, there was a 190% increase compared to those in 2023. 16% of all reports were made within 24 hours however just 9% of incidents were reported after one week, placing marketing well above average in this category.
To calculate this number, they analyzed data from the Information Commissioner’s Office (ICO) to identify how many times each sector reported cyber security incidents to the IOC in the first three quarters of 2023 and 2024. Once the figures for each sector were established, the year-on-year percentage change was calculated using the figures from 2023 and 2024.
Membership association saw the second largest growth from 2024, with 84% more reports at 215. These likely include breaches from the Conservative Party after it revealed hundreds of email addresses and UNISON’s personal data breach.
At an increase of 74%, social care reported 266 incidents in 2024 - up from 153 in the first three quarters of 2023. This is followed by the justice sector which saw a 67% increase compared to 2023.
The sector with the fifth largest growth is health at 62%. A huge 22% of these incidents took over one week to be reported, however, 22% were also reported in less than 24 hours - placing health among the highest of all sectors.
The retail sector reported a 40% rise in cyber security incidents to the ICO in 2024. They saw the biggest overall increase of reports at 611 more than the previous year. Just 12% of incidents were reported in 24 hours, while 15% of those were not reported until more than a week after the breach.
On the other end of the spectrum is finance, insurance and credit which reported 40% fewer breaches than the year prior - the third largest drop of all sectors. They also reported the largest total reduction in incidents at 520. 14% of reports were made within 24 hours - around average compared to other sectors - however, a huge 17% took over one week to be reported.
The charity and voluntary sector reported 6% fewer breaches than the year prior - the eighth largest drop of all sectors. They also reported the fifth-largest overall reduction in incidents at 38. However, placing the sector well below average, just 9% of all breaches were reported within 24 hours.
The education sector reported a 9% drop in cyber security incidents than the year prior - the seventh largest of all sectors. They also reported the second-largest overall reduction in incidents at 38. Placing them above average, 19% of incidents were reported within 24 hours.
During the first three quarters of 2024, most incidents were reported between 24 hours to 72 hours after the breach had occurred. This may be because they hadn’t noticed, were busy trying to deal with the situation themselves or weren’t aware of the seriousness. Regardless, less than 24 hours is the optimal time. However, this is a step in the right direction as these numbers are up 26% from 2023 as 4,558 reported within this timeframe in 2024.
The second most common time taken to report is 72 hours to one week. There was a 2% reduction in the number of businesses leaving it during this time period.
In third in less than 24 hours, 1,320 businesses reported their cyber security breaches within this timeframe. However, this number is a 2% drop compared to the 1,507 reported in 2023.
The least common time taken to report an incident is more than one week. Luckily, the numbers show there’s been a 14% decrease in the number of businesses waiting to report. In 2023, 1,474 businesses waited more than one week but in 2024 that number dropped to 1,269.
Venky Sundar, Founder and President of Indusface explains why cyber security training is so important for businesses: "With data breaches costing businesses an average of $4.45 million globally in the last year, it raises the question of just how critical it is for organizations to provide employees with comprehensive training on what constitutes sensitive data and how they can protect it, as well as what is at stake if they do not adhere to the policies".
"And training doesn’t have to be monotonous, for example setting up phishing email simulators to engage the team and allow them to see the potential dangers in action. These simulations show how quickly and easily attacks can happen, helping employees develop practical, hands-on skills for spotting suspicious activity."
“Cybersecurity threats evolve constantly, so training should be regular, not a one-time event. Regular training and guidance will ensure that employees receive tailored guidance on securing their work equipment, home offices, use of VPNs, and recognizing the unique threats posed by both in-office and home working environments.”
Businesses in the communication sector tend to treat cyber security as a higher priority than any other, with 65% saying it is a “very” high priority. While finance and health trail behind in the top five. But has this translated into a reduction in attacks? According to the ICO, no. The number of cyber security incident reports increased by 6% across all sectors - up to almost 9,000.
Which types of cyber security incidents are growing in frequency?
Analyzing how many times six major cyber security incidents were reported to the ICO in the first three quarters of 2023 and 2024 and calculating the year-on-year percentage change, Reboot Online highlights that phishing has seen the largest growth in reports. The ICO received almost 3,400 phishing reports, compared to 2,053 in 2023 - the equivalent of 12 phishing incidents a day.Back in 2022, 91% of UK companies responding to their survey stated they had experienced at least one successful email-based phishing attack in 2022.
Malware was the second most commonly reported incident with 362, compared to 395 in 2023. However, that was an 8% drop compared to 2023. This trend continues for all other cyber incidents as they all saw a decrease in successful attacks.
Ransomware was the third most reported incident of 2024, with businesses noting a 13% overall decrease in attacks. There were 3,011 cases reported last year, but a huge 3,460 in the year before.
Brute force takes fourth with a 32% decrease in reports - noting 212 in 2024 and 311 in 2023. Unauthorized access saw a 45% decrease with 177 reports in 2024 down from 323 in 2023. Denial of service is sixth with an 83% decrease in 2024 reports down to 1 from 6 in 2023.
Which sector was hit hardest by cyber attacks in 2024?
It was found that the marketing sector reported the largest year-on-year percentage growth for cyber security incidents.With an additional 76 reports in the first three quarters of 2024, there was a 190% increase compared to those in 2023. 16% of all reports were made within 24 hours however just 9% of incidents were reported after one week, placing marketing well above average in this category.
To calculate this number, they analyzed data from the Information Commissioner’s Office (ICO) to identify how many times each sector reported cyber security incidents to the IOC in the first three quarters of 2023 and 2024. Once the figures for each sector were established, the year-on-year percentage change was calculated using the figures from 2023 and 2024.
Membership association saw the second largest growth from 2024, with 84% more reports at 215. These likely include breaches from the Conservative Party after it revealed hundreds of email addresses and UNISON’s personal data breach.
At an increase of 74%, social care reported 266 incidents in 2024 - up from 153 in the first three quarters of 2023. This is followed by the justice sector which saw a 67% increase compared to 2023.
The sector with the fifth largest growth is health at 62%. A huge 22% of these incidents took over one week to be reported, however, 22% were also reported in less than 24 hours - placing health among the highest of all sectors.
The retail sector reported a 40% rise in cyber security incidents to the ICO in 2024. They saw the biggest overall increase of reports at 611 more than the previous year. Just 12% of incidents were reported in 24 hours, while 15% of those were not reported until more than a week after the breach.
On the other end of the spectrum is finance, insurance and credit which reported 40% fewer breaches than the year prior - the third largest drop of all sectors. They also reported the largest total reduction in incidents at 520. 14% of reports were made within 24 hours - around average compared to other sectors - however, a huge 17% took over one week to be reported.
The charity and voluntary sector reported 6% fewer breaches than the year prior - the eighth largest drop of all sectors. They also reported the fifth-largest overall reduction in incidents at 38. However, placing the sector well below average, just 9% of all breaches were reported within 24 hours.
The education sector reported a 9% drop in cyber security incidents than the year prior - the seventh largest of all sectors. They also reported the second-largest overall reduction in incidents at 38. Placing them above average, 19% of incidents were reported within 24 hours.
How long do businesses take to report cyber security incidents?
Delayed reporting of cyber security incidents can lead to severe consequences for an organization, so reporting them immediately is vital to reduce the damage and prevent potential threats getting worse over time. But do businesses stick to this advice?During the first three quarters of 2024, most incidents were reported between 24 hours to 72 hours after the breach had occurred. This may be because they hadn’t noticed, were busy trying to deal with the situation themselves or weren’t aware of the seriousness. Regardless, less than 24 hours is the optimal time. However, this is a step in the right direction as these numbers are up 26% from 2023 as 4,558 reported within this timeframe in 2024.
The second most common time taken to report is 72 hours to one week. There was a 2% reduction in the number of businesses leaving it during this time period.
In third in less than 24 hours, 1,320 businesses reported their cyber security breaches within this timeframe. However, this number is a 2% drop compared to the 1,507 reported in 2023.
The least common time taken to report an incident is more than one week. Luckily, the numbers show there’s been a 14% decrease in the number of businesses waiting to report. In 2023, 1,474 businesses waited more than one week but in 2024 that number dropped to 1,269.
Venky Sundar, Founder and President of Indusface explains why cyber security training is so important for businesses: "With data breaches costing businesses an average of $4.45 million globally in the last year, it raises the question of just how critical it is for organizations to provide employees with comprehensive training on what constitutes sensitive data and how they can protect it, as well as what is at stake if they do not adhere to the policies".
"And training doesn’t have to be monotonous, for example setting up phishing email simulators to engage the team and allow them to see the potential dangers in action. These simulations show how quickly and easily attacks can happen, helping employees develop practical, hands-on skills for spotting suspicious activity."
“Cybersecurity threats evolve constantly, so training should be regular, not a one-time event. Regular training and guidance will ensure that employees receive tailored guidance on securing their work equipment, home offices, use of VPNs, and recognizing the unique threats posed by both in-office and home working environments.”
Methodology:
Reboot Online analyzed data from the Information Commissioner’s Office (ICO) for the first three quarters of 2023 and 2024, focusing on six major cybersecurity incidents: phishing, unauthorized access, ransomware, malware, hardware/software misconfiguration, and brute force. The analysis included:
Reboot Online analyzed data from the Information Commissioner’s Office (ICO) for the first three quarters of 2023 and 2024, focusing on six major cybersecurity incidents: phishing, unauthorized access, ransomware, malware, hardware/software misconfiguration, and brute force. The analysis included:
- The number of times each of the six incidents was reported to the ICO during Q1-Q3 of both years.
- The time it took for businesses to report these incidents to the ICO within the same period.
- A year-on-year comparison of reported incidents, calculating percentage changes from 2023 to 2024.
- A ranking of incidents by the highest percentage increase in reports.
The analysis excluded Q4 2024 data due to its unavailability and removed political sector results due to inconsistent reporting.
Read next: New Research Shows Despite Increase in Ransomware Attacks in 2024, There Was a Decline in Its Payments
Read next: New Research Shows Despite Increase in Ransomware Attacks in 2024, There Was a Decline in Its Payments
