Information on cyber incidents - May 2025

The total number of material cyber incidents reported to the FCA in 2024 is 166.

Please note, there is often a delay between when an incident occurs, when it is detected, and when it is reported.

This can mean that, in certain circumstances, incidents reported in 2024 may refer to incidents that occurred outside of that period.

Of the 166 material cyber incidents reported by firms, 89 of these were attributed to cyber-attacks.

For the purposes of this request, we define a ‘data breach’ as ‘a confirmed incident in which the confidentiality of company or personal data is compromised or breached’. This does not necessarily mean that, in every case, persona or company data was exfiltrated or stolen.

In relation to personal data, the Information Commissioner’s Office (the ICO) is the UK’s regulatory authority responsible for upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The Data Protection Act 2018 (DPA 2018) and the General Data Protection Regulation (GDPR) do not require firms to report personal data breaches or compromises to the FCA. However, firms should consider reporting material operational incidents to us in line with the general notification requirements set out in SUP 15[1] of the FCA’s Handbook. We are not required to report personal data breaches or compromises regarding firms to the ICO; this responsibility lies with the firms themselves. As firms are not mandated to report these breaches to us, we cannot verify the accuracy of the reported figures as a proportion of cyber incidents involving data breaches.

Of the 166 material cyber incidents reported to the FCA in 2024, 33 cyber incidents were reported to  involve a data breach. Due to the nature of cyber incidents, this number is subject to change if further information is identified that indicates a data breach occurred.

Firms reported to us that, of the 166 material cyber incidents, 19 incidents involved ransomware.