Information on cyber security

Reference Case Number: FOI2025/01435

Freedom of Information: Right to know request:

1. The total number of material cyber incidents reported to the FCA in the financial years: 2019-20, 2020-21, 2021-22, 2022-23, 2023-24, 2024-25, and 2025-26 (so far).

2. For each of the years, please provide a subcategory of the number of material cyber incidents that were attributed to cyber-attacks, that were attributed to ransomware, that were attributed to Distributed Denial of Service, that were attributed to phishing.

If you estimate that this request will extend beyond the time and budget cap if completed in full, please prioritise the years 2025-26 (so far), 2024-25 and 2023-24 (in that order).

FCA response:

It may be helpful to explain that we hold centralised records on material operational incidents reported to the FCA by individual firms under Supervision manual (SUP) 15.3 and Principle 11. This includes incidents that are a result of cyber-attacks.

These figures do not include incidents that have not been reported directly to the FCA.

The data provided is accurate as of 25 November 2025 and is subject to change where there are ongoing investigations of incidents and root causes.

Delays between incidents, detection and reporting may mean some instances are reported in a different time period.

Incidents are categorised into three principal domains:

Technology: Includes, but is not limited to, delayed payments, late submissions, customer connectivity failures, change management deficiencies, and database malfunctions.
Cyber: Encompasses incidents arising from malicious activity, including phishing, distributed denial-of-service (DDoS) attacks, and ransomware.
Non-Technology: Covers incidents such as power outages attributable to natural disasters or theft.

Cyber incidents are further divided into two primary high-level root cause elements:

Cyberattacks: Malicious acts directed against the Firm, including phishing and/or credential compromise, DDoS, ransomware, etc.
Third-Party Cyber: Equivalent malicious acts perpetrated against third-party entities that impact a regulated entity.

We now turn to your request. Please find below response to your questions below:

Question 1

Table 1 below details the volume of cyber incidents reported by firms which are either attacks directly on firms or cyber incidents at third parties that impact firms, as outlined above.

Table 1. Material cyber incidents reported to the FCA, by financial year (1 April to May 31)
2019-2020	Material Cyber Incidents
2020-2021	121
2021-2022	181
2022-2023	113
2023-2024	207
2024-2025	138
2025-2026	116

Question 2

We have interpreted this question as referring to attacks against firms (and not against third parties which may then have impacted firms). These attacks are classified according to the primary cyber methodology identified within each incident. Only one methodology is recorded per incident, even where multiple categories apply (and as such, does not record where a firm has had a cyber-attack that has consisted of both phishing and ransomware, for example).

Table 2. Material cyber incidents attributed to cyber-attacks, including the number linked to ransomware, distributed denial-of-service (DDoS), or phishing and/or credential compromise.
Year	Cyber: Total Material Cyberattacks Against Firms ¹	Ransomware	DDoS	Phishing and/or Credential compromise
2019-2020	105	10	11	69
2020-2021	113	23	21	58
2021-2022	81	24	12	35
2022-2023	103	22	30	35
2023-2024	106	21	12	50
2024-2025	85	20	15	40
2025-2026	45	9	7	13

Date of Release: 09/12/2025

Information on cyber security - December 2025

Freedom of Information: Right to know request:

FCA response:

Question 1

Question 2

More information

Data