Tech & Innovation

NCSC Annual Review 2026: 80 Nationally Significant Cyber Attacks and What Small Businesses Should Learn

The NCSC's Annual Review 2026, published on 3 November, says it received 1,831 cyber attack reports between September 2025 and August 2026, of which 337 needed its support and 80 were nationally significant. Most successful attacks exploited familiar weaknesses.

By Entrepreneur Group · Published 5 November 2026

The National Cyber Security Centre (NCSC) received 1,831 reports of cyber attacks on UK organisations in the year to 31 August 2026. Its Annual Review 2026, published on 3 November, says 337 of those incidents needed NCSC support and 80 were nationally significant. Its main lesson for businesses is that most successful attacks still exploit familiar, fixable weaknesses.

The review covers 1 September 2025 to 31 August 2026. It also says the NCSC's Early Warning service sent notifications to 8,500 organisations about activity suggesting their systems might have been compromised.

The headline figures

From the NCSC's incident management chapter:

• 1,831 reports of cyber attacks received
• 337 incidents that needed NCSC support after triage
• 80 nationally significant incidents
• 8,500 organisations notified through Early Warning

The NCSC says incident reporting "does not follow a simple year-on-year trend", so it does not present these as a rise or fall on last year.

Seven lessons from the incidents

The review sets out seven things it learned from the 337 incidents. In short:

• Attackers exploit the basics: known flaws, weakly protected systems and internet-facing assets.
• People remain the target, through manipulation and stolen credentials.
• State and criminal attackers get in through similar routes.
• Ransomware remains highly disruptive, and recovery can take a long time.
• Preparation, such as logging, monitoring and incident response plans, shapes outcomes.
• Early action, including acting on Early Warning alerts, reduces impact.
• Attackers don't have to be sophisticated to gain access.

The NCSC concludes that "Most successful attacks continue to exploit familiar weaknesses."

Fridges, freezers and old technology

The review came out the same day UK meat processors were caught up in attacks on refrigeration systems across Europe. ITV News reported that the Association of Independent Meat Suppliers said a few of its roughly 300 members were affected after fridges heated up overnight. The units were empty, so no food was lost, and no major UK supermarket was directly affected. Paul Chichester, the NCSC's director of operations, said: "At the moment, the impact is minimal." ITV reported that the French supermarket attack involved legacy technology connected to the internet with default passwords.

In his launch speech, NCSC chief executive Richard Horne pointed to "the disruption of refrigeration units across Europe" as an example of attacks on technology that controls physical processes. He criticised "End-of-life systems kept running for just one more year" and called for passkeys to become the norm. He said the most immediate risk from AI is not new: attackers are using it to exploit old weaknesses faster.

What it means for small businesses

This section is editorial guidance. The review's message is that the basics still stop most attacks. For a small business, that means:

• Find everything connected to the internet. That includes building controls, refrigeration, CCTV and card machines, not only laptops. Change any default passwords.
• Patch and replace. Keep software updated and plan to replace systems that no longer get security updates.
• Turn on stronger log-ins. Use multi-factor authentication or passkeys wherever they are offered.
• Sign up for Early Warning. The NCSC's Early Warning service is free for UK organisations and emails alerts about malware and vulnerabilities affecting your network.
• Work towards Cyber Essentials. The NCSC says Cyber Essentials covers the basic controls, and a 75% discount for small firms opened on 3 November.
• Have a plan. Decide who you would call and what you would switch off if something went wrong.

Frequently asked questions

How many cyber attacks did the NCSC deal with in 2026?

The NCSC's Annual Review 2026 says it received 1,831 reports of cyber attacks between 1 September 2025 and 31 August 2026. Of those, 337 needed NCSC support and 80 were nationally significant.

What is the NCSC Early Warning service?

It is a free NCSC service for UK organisations that sends email alerts about malware, vulnerabilities and suspicious activity affecting your network. The NCSC says it notified 8,500 organisations in the year to August 2026.

Were UK businesses affected by the European fridge cyber attacks?

Yes, a small number. ITV News reported that a few UK meat processors had refrigeration units heat up overnight, but the units were empty and the NCSC said the impact was minimal.

Sources

1. NCSC: Annual Review 2026, Incident management (reviewed 5 November 2026)
2. NCSC: Annual Review 2026, 7 things we learned (reviewed 5 November 2026)
3. NCSC: Richard Horne's speech at the NCSC Annual Review 2026 launch (3 November 2026) (reviewed 5 November 2026)
4. ITV News: UK meat processing firms hit amid fridge and freezer cyber attacks (3 November 2026) (reviewed 5 November 2026)
5. NCSC: Early Warning (reviewed 5 November 2026)