Cyber attacks can steal data, take over accounts, disrupt services and enable fraud. Attackers increasingly combine technical weaknesses with social engineering. To protect themselves, businesses need to understand both established methods and emerging threats.
The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses and 28% of charities identified a cyber security breach or attack in the previous 12 months. This equates to approximately 612,000 businesses and 57,000 charities. The figures cover incidents that organisations detected and were willing to report, so the true prevalence may be higher.
This blog explains 15 types of cyber attacks, where they overlap and the practical steps organisations can take to reduce the risk.
A cyber attack is a deliberate attempt to gain unauthorised access to a device, account, system or network, or to steal, alter, destroy or make data and services unavailable. Attackers may be financially motivated criminals, state-linked groups, hacktivists or individuals acting for other reasons.
An attempted attack does not always result in a breach. Similarly, not every cyber incident is a personal data breach. If personal data is affected, the organisation must assess its duties under the UK GDPR and Data Protection Act 2018.
The NCSC Annual Review 2025 recorded 429 incidents requiring NCSC support between 1 September 2024 and 31 August 2025. Of these, 204 were classed as nationally significant and 18 as highly significant. These are incidents handled by the NCSC, rather than an estimate of every attack affecting the UK.
Cyber attack labels are not mutually exclusive. A phishing message may steal a password, for example, and the compromised account may then be used for business email compromise or to deploy ransomware. The categories below distinguish the main method or objective and summarise the key risks and controls.
The official Cyber Security Breaches Survey does not publish a separate prevalence figure for every technical method below, so statistics are included only where comparable 2025/2026 data is available. (DSIT and Home Office, 2026)
Malware is malicious software designed to harm a device or system, steal information or give an attacker unauthorised control. It includes viruses, worms, trojans, spyware, information stealers and ransomware. Malware may arrive in an attachment, a compromised download or website, or through exploitation of a software vulnerability.
In the 2025/2026 survey, 7% of businesses and 3% of charities said their devices had been targeted with viruses, spyware or other malware. (DSIT and Home Office, 2026)
Malware does not always spread by itself, and infection does not always produce obvious symptoms. Layered controls should include supported and patched software, restricted privileges, endpoint protection, monitoring and protected backups. (NCSC malware and ransomware guidance)
Phishing uses fraudulent messages or websites to persuade someone to disclose information, make a payment, open an attachment or sign in to a fake service. It may be a mass campaign or a targeted spear-phishing attempt.
Phishing remained the most commonly identified attack in the 2025/2026 survey, affecting 38% of businesses and 25% of charities. It was also named as the most disruptive type by 69% of affected businesses and charities. (DSIT and Home Office, 2026)
Smishing delivers the deception by text or messaging app, while vishing uses calls or voice messages.
Business email compromise (BEC) is a targeted form of business payment fraud. An attacker uses a compromised or convincing lookalike email account to impersonate a director, colleague, supplier or client. The message may request a payment, a change to bank details or the release of sensitive information. It may contain no malicious link or attachment, so conventional malware scanning alone may not stop it. (NCSC business payment fraud guidance)
In 2025/2026, 12% of businesses and 7% of charities reported people impersonating their organisation or staff in email or online. (DSIT and Home Office, 2026)
BEC exploits business processes as well as technology. Payment and account-change requests should be independently verified through an established contact route.
Ransomware is malware that prevents access to systems or data, commonly by encryption. Attackers may also steal information and threaten to publish it, a tactic often called double extortion. Paying a ransom does not guarantee that access will be restored or stolen data deleted.
The 2025/2026 survey found that 1% of businesses and 1% of charities identified ransomware attacks. It estimated that approximately 9,000 UK businesses and 1,000 charities experienced ransomware cyber crime during the reference period. (DSIT and Home Office, 2026) The percentages are lower than for phishing, but a successful attack can stop critical operations and make recovery lengthy and costly.
Credential attacks target passwords and other sign-in information. Brute-force attacks automate repeated guesses against one account. Password spraying tries a small number of common passwords across many accounts, while credential stuffing tests username and password combinations stolen from another service.
Strong, unique passwords stored in an approved password manager reduce reuse. Organisations should use passkeys where supported or add multi-factor authentication (MFA) where passwords remain. Rate limiting, monitoring for unusual sign-ins and removing unused accounts also help.
The NCSC advises small organisations to prioritise passkeys for email accounts where available and otherwise use a strong, separate password with two-step verification. (NCSC secure email guidance, 2026)
Generative AI is making established attacks easier to personalise and scale. It can produce convincing messages, fake websites, synthetic images and cloned voices. The NCSC’s 2025 assessment says AI is already enhancing reconnaissance, social engineering, basic malware generation and vulnerability research. It expects AI mainly to increase the volume and effectiveness of existing methods, rather than create entirely new attack types before 2027.
The Report Fraud Annual Assessment 2025/26 found that reports in which victims identified AI as a factor rose from 193 to 956, an increase of 395%. Reported losses linked to AI-enabled crime rose from £1.2 million to £9.6 million. Victims described AI-generated videos, cloned voices, manipulated images, fake websites and chatbots used to make fraud attempts more convincing.
Familiar writing, a recognisable voice or an apparently live video should not be treated as proof of identity. Unusual payment, access and data-sharing requests still require independent verification.
An on-path attack, traditionally called a man-in-the-middle attack, occurs when an attacker intercepts communications between two parties. Depending on the connection and controls in place, the attacker may read the traffic, steal credentials or alter information in transit.
Encryption such as HTTPS and correctly configured secure connections makes intercepted traffic harder to use. Organisations should also keep devices and network equipment updated, avoid sending sensitive information over untrusted connections and use an approved VPN where their security policy requires one.
Account takeover occurs when an attacker gains control of an email, cloud, website or social media account. Stolen credentials are one route, but attackers may also steal session tokens or manipulate a helpdesk into resetting a password or MFA method.
The 2025/2026 survey found that 2% of businesses and 1% of charities experienced takeovers or attempted takeovers of websites, social media accounts or email. (DSIT and Home Office, 2026) Following attacks affecting retailers in 2025, the NCSC recommended stronger helpdesk identity checks, comprehensive MFA and monitoring for unauthorised account use. (NCSC, 2025)
Structured Query Language (SQL) injection exploits an application that builds database queries unsafely from user-controlled input. The attacker inserts commands that the application treats as part of the query, which can expose, alter or delete data and may sometimes support wider system compromise.
This is primarily a secure-development issue, not something employees can identify reliably during normal use. OWASP guidance recommends parameterised queries as a primary defence, supported by input validation and least-privilege database accounts.
Cross-site scripting (XSS) occurs when a web application allows untrusted content to run as script in another user’s browser. An attacker may use it to steal session information, change what a page displays or perform actions in the user’s session.
Developers should use context-appropriate output encoding, safe frameworks, input validation and other controls described in OWASP’s XSS prevention guidance. A web application firewall may add protection but should not replace secure design and coding.
Attackers exploit weaknesses in software, devices or configuration to gain access, run code or increase their privileges. A known vulnerability has been disclosed and may already have a security update. A zero-day is not yet patched or may not yet be known to the supplier.
The NCSC expects AI-enabled tools to increase attackers’ ability to find and exploit known vulnerabilities by 2027, shortening the time available to apply security fixes. (NCSC, 2025) Organisations need an accurate asset inventory, supported products, prompt risk-based patching and a process for urgent vendor mitigations when a fix is not yet available.
A supply-chain attack reaches an organisation through a trusted supplier, service provider, software package or digital connection. Compromise of a third party can give the attacker access to several customers or allow malicious code to arrive through a channel that normally appears legitimate.
Only 15% of businesses in the 2025/2026 survey said they reviewed cyber risks from immediate suppliers, and 6% reviewed their wider supply chain. (DSIT and Home Office, 2026) The NCSC’s supply-chain security guidance, reviewed in October 2025, recommends understanding the risks, establishing controls, checking arrangements and improving them as the supply chain changes.
A denial-of-service (DoS) attack exhausts a service’s resources so legitimate users cannot access it. A distributed denial-of-service (DDoS) attack sends traffic or requests from multiple sources, often a botnet of compromised devices. These are variations of the same objective and are combined here to avoid duplication.
In 2025/2026, 3% of businesses and 1% of charities identified a DoS attack. (DSIT and Home Office, 2026) Organisations cannot eliminate the risk completely, but capacity planning, resilient suppliers, monitoring, graceful degradation and a rehearsed response plan can reduce disruption. (NCSC DoS guidance)
The Domain Name System (DNS) directs domain names to internet addresses. DNS cache poisoning feeds false information into a resolver, while DNS hijacking changes a domain’s records or compromises the registrar account. Both can redirect users to attacker-controlled services even when they enter the expected domain name.
Controls may include strong authentication for registrar and DNS administration, restricted permissions, monitoring for unauthorised record changes, registry lock services and DNS Security Extensions (DNSSEC) where appropriate. DNSSEC helps validate signed DNS data but does not replace account security or monitoring.
Sounding like something out of Grand Theft Auto, a drive-by attack is where a hacker embeds malicious code in a vulnerable and insecure website. The script is ignited once the user visits the site, infecting their computer. Victims merely have to ‘drive-by’ the site to be hit. No need to interact with it.
A drive-by download occurs when a compromised or malicious website causes unwanted software to be downloaded, sometimes by exploiting an unpatched browser or plug-in. Malvertising uses malicious online adverts to redirect users to scams, exploit pages or malware.
Simply viewing a page does not guarantee infection, and some attacks still require the user to click or approve a download. Supported browsers, prompt updates, web filtering, restricted administrator rights and controls on software installation reduce the likelihood that a visit becomes a compromise.
No single measure prevents every attack. These ten controls address several of the attack types above:
- Use secure sign-in. Use passkeys where available. Where passwords remain, use unique passwords stored in an approved password manager and enable MFA, especially for email, finance and administrator accounts.
- Keep an accurate asset inventory and install security updates. Prioritise internet-facing and security-critical systems, and replace products that no longer receive support.
- Protect and test backups. Keep multiple copies, including one that attackers cannot alter through the live network. Test that critical data and systems can be restored.
- Limit access and privileges. Give users and applications only the access they need. Separate administrator accounts from routine email and browsing.
- Filter malicious content. Use appropriate email, web, DNS and endpoint controls. Configure email authentication such as DMARC, SPF and DKIM to make domain spoofing harder.
- Verify high-risk requests. Confirm payment instructions, bank-detail changes, password resets and sensitive data requests through an established second channel using contact details already held in company records.
- Monitor and log important activity. Look for unusual sign-ins, privilege changes, large data transfers and unexpected changes to accounts or DNS records.
- Assess supplier access and dependencies. Identify which suppliers can reach critical systems or data, set proportionate security requirements and remove access that is no longer needed.
- Prepare and rehearse an incident response plan. Assign responsibilities, keep offline contact details and decide how critical services will continue during disruption.
- Support awareness and prompt reporting. Help staff recognise suspicious requests and make reporting straightforward and blame-free. Awareness should work alongside technical and procedural controls, not substitute for them.
Follow the incident response plan to contain the attack, preserve evidence, protect unaffected systems and restore services safely. Avoid deleting logs or rebuilding affected devices before the incident team has considered what evidence may be needed.
Fraud and cyber crime should be reported through Report Fraud, which replaced Action Fraud in December 2025. Organisations in Scotland should report to Police Scotland. Significant cyber incidents can also be reported to the NCSC. Contact the bank immediately if money has been sent or account details have been changed.
If personal data is involved, assess the risk to people’s rights and freedoms. The ICO’s current guidance states that a notifiable personal data breach must be reported without undue delay and, where feasible, within 72 hours of awareness. All personal data breaches must be recorded, and affected people must be informed without undue delay where the breach is likely to create a high risk to their rights and freedoms.
Marks & Spencer reported a cyber incident in April 2025 that disrupted contactless payments and Click & Collect, delayed some online orders and led the retailer to move some processes offline. In its full-year results published in May 2026, the company reported £131.3 million in incident-related costs. Fashion, Home & Beauty online sales fell by 18.4% during the year, reflecting the pause in online orders and gradual recovery.
The example illustrates why survey medians should not be read as a ceiling. Across all businesses that identified a breach or attack in the 2025/2026 survey, the median perceived cost of the most disruptive incident was £0. Among businesses that experienced an outcome, however, the median was £560 and the 95th percentile was £15,000. A small number of major incidents can cause much greater losses. (DSIT and Home Office, 2026)
Understanding different types of cyber attacks helps staff recognise suspicious activity, follow verification procedures and report concerns promptly. Awareness is one part of a wider system that should also include technical controls, secure processes, management oversight and incident planning.
Human Focus Cyber Security Awareness Training helps trainees recognise common cyber threats and understand appropriate steps for protecting information and reporting concerns. GDPR Awareness Training provides complementary awareness of responsibilities when handling personal data.
