12 March 2026
The NCSC responded to 1,131 incident reports in quarter four of 2025. Phishing and credential harvesting was the most frequently lodged incident by businesses during that period, making up a third of all business reports.
As well as key reporting statistics, the Cyber Security Insights report warns against blurring the boundaries between professional and personal online activity.
“Using a work email address or password for personal reasons may not seem like a big deal, but the consequences can be far-reaching to both you and your organisation,” said NCSC Chief Operating Officer, Mike Jagusch.
He warned that using work credentials outside the workplace significantly increases risk exposure.
“If you’ve used business credentials on a website subsequently involved in a data breach, cyber threat actors can use these credentials to gain access to your work email accounts, and further access to work systems,” says Jagusch.
“This can enable them to carry out cyber security attacks such as phishing, social engineering, ransomware and other scams and fraudulent activity.”
The same behaviours that expose work credentials externally can also happen internally within a business.
The report explains how to manage or prevent staff from using technology for work purposes that hasn’t been approved or authorised by the business. This practice is commonly referred to as ‘shadow IT’.
“Shadow IT includes things like forwarding work emails to a personal account or storing business documents in a private cloud account,” says Jagusch. “If the business isn’t aware of this activity, it can’t put in place the necessary security protections to prevent a threat such as data leakage, privacy breaches and even legal implications.”
The report reinforces the need for stronger cyber security awareness at both an organisational and personal level.
“It’s important that organisations train staff to understand cyber security risks so they can do their jobs in a safe manner and take this awareness into their everyday lives as well,” said Mr Jagusch.
Read the Quarter Four 2025 Cyber Security Insights report
Key data highlights – Q4 2025
- The NCSC responded to 1,131 incident reports and of these, 90 incidents were triaged for specialist technical support due to their potential national significance.
- Of the incidents triaged and assessed by specialist support, 51% were likely linked to cybercrime actors.
- Of the 117 reports by organisations processed through our general triage, 34% were for phishing and credential harvesting.
- Scams and fraud continued to be the most common incident category reported by individuals at 46%, but has decreased slightly from 446 in Q3 to 432 in Q4.
- Compared to the previous quarter, there was a 75% decrease in direct financial loss reported during Q4, at $3.2M.
- Incidents $10,000 and over made up $2.9M (93%) of reported loss, despite consisting of only 39 incidents.