HOW COMMON
Three in ten charities
The Cyber Security Breaches Survey 2025 found 30% of UK charities had a breach or attack in the last 12 months, about 61,000 charities.
See the figures
WHAT THE NCSC SAYS
Small group,
real target.
Being small does not make a group invisible online.
The UK's 2025 Cyber Security Breaches Survey found three in ten charities had a breach or attack in the previous year. The National Cyber Security Centre's guide for small organisations sets out simple steps, many of which it says take as little as five minutes. This page is an independent informational guide, not an institute or IT provider.
5 MINUTES for many of the steps
See the figures- Secure the email first
- Lock every device
- Keep a backup
- Cyber security is everyone's business
THE SHORT ANSWER
Start with email,
end with a backup.
The NCSC guide runs in a clear order.
You don't need to be a technical expert.
BACKUPS
A copy you can restore
The NCSC says to back up all the data your organisation needs, online or on a USB stick or external drive, so you can restore it after ransomware, loss or theft.
The five steps
DEVICES
Lock every phone and laptop
Use a 6-digit PIN or strong password, or fingerprint or face recognition, on every device, including personal ones used for the group and shared tablets.
Shared devices
THE NCSC'S FIVE STEPS
In the order
the guide gives them.
The NCSC's small organisations guide has five practical pages after its introduction. Here they are in brief.
Secure your email
Use passkeys where your email provider supports them; otherwise a strong password with 2-step verification.
Secure important accounts
Then check banking, social media, online storage and website accounts, using passkeys or 2SV.
Protect your devices
Lock every phone, laptop and shared tablet with a 6-digit PIN, strong password or biometrics.
Back up, then spot attacks
Keep a backup of the data you need, and learn the signs of phishing and unusual account activity.
TWO NUMBERS WORTH KNOWING
Common,
and not cheap.
One figure on how often,
one on what it can cost.
30%
UK charities with a breach or attack in a year
About 61,000 charities identified a cyber breach or attack in the past year, according to the government survey.
PREVALENCE · CSBS 2025
£3,240
Average cost of a charity's most disruptive breach
The self-reported average, including those reporting no cost. Excluding £0 responses, the average was £8,690. The survey says these may underestimate the full impact.
COST · CSBS 2025
The NCSC's small organisations guide notes that 85% of cyber attacks against businesses start with a scam email.
WHAT THE SURVEY FOUND
Pick a figure,
see the share.
Choose a finding from the government's Cyber Security Breaches Survey 2025. The bar shows how large each share is.
Source: GOV.UK, Cyber Security Breaches Survey 2025 (DSIT and Home Office). General information, not professional security advice.
SHARED DEVICES
The booking tablet
counts too.
The NCSC points out that shared devices, such as tablets used for bookings or meetings, hold important information too. If they are shared, set a PIN or password as well as any fingerprint or face recognition so others can still unlock them.
Phones and tablets leave the building more often, so they are more likely to be lost or stolen. The guide also stresses not leaving cyber security to a single person: every member of the team should see it as everyone's business.
Questions
Questions people ask
Are small charities really targeted?
Yes. The Cyber Security Breaches Survey 2025 found 30% of UK charities had a breach or attack in the last 12 months. The NCSC says small businesses are just as likely to experience online crime as larger ones.
What is the most common attack?
Phishing. Of charities that had a breach or attack, 86% experienced phishing, the most common and most disruptive type in the survey.
Where should a small group start?
The NCSC guide starts with securing email, ideally with passkeys, then other important accounts, then devices, backups and spotting attacks. It also offers a free Cyber Action Toolkit for first steps.
Does a backup have to be expensive?
No. The NCSC says most online storage providers offer limited free storage, and you can also back up to a USB stick or external hard drive.
Is this site an IT provider or institute?
No. This is an independent informational guide that quotes the NCSC and GOV.UK. It is not an institute, club, church or IT company, and it does not offer support or ask for any details.
Sources
- NCSC: Small organisations guide to cyber security
- NCSC: Protecting your devices (small organisations guide)
- NCSC: Backing up your data (small organisations guide)
- NCSC: Spotting cyber attacks (small organisations guide)
- NCSC: Cyber security advice for small to medium sized organisations
- GOV.UK: Cyber Security Breaches Survey 2025
Updated