UK cyberattacks hit record high as criminals pivot to new extortion tactics

British organizations reported a record 1,371 cyber incidents to the Information Commissioner's Office (ICO) between July and September 2026, marking the highest quarterly total since the regulator began publishing data. This surge comes as cybersecurity firms describe being overwhelmed with cases, sometimes turning away clients, while criminals increasingly use data leak sites to extort victims rather than traditional encryption-based ransomware. The ICO's broader data security incident reports—including non-cyber breaches like misdirected emails—also reached a new quarterly peak of 4,604.

The data suggests a significant shift in criminal tactics: while reported ransomware incidents have sharply declined, experts note a rise in data extortion attacks where stolen information is used for leverage. The regulator classifies most new incidents under a vague 'other cyber incidents' category, leaving the exact nature of these attacks unclear. For engineers and security teams, this signals that perimeter defenses must evolve beyond just blocking encryption malware to protect against sophisticated data theft and extortion campaigns. The takeaway: the threat landscape is intensifying and morphing, demanding more proactive data protection strategies as traditional attack metrics become less reliable.