10 Backup and Recovery Statistics for UK Businesses (2026)

The good news first: having no backup at all is now unusual for a UK business. The figures that should worry a small business owner are about what happens next. Who decides what to restore, how long it takes, and whether the backup works when it’s finally needed.

Most of the figures below come from the UK government’s Cyber Security Breaches Survey 2025/2026, published in April 2026, which surveyed 2,112 UK businesses. Where we’ve used a global or industry source, we say so. Older figures that did the rounds for years (“60% of businesses close within six months of losing data” and the like) have been left out, because we couldn’t trace them to a current, reliable source.

Do UK businesses back up?

1. 88% of UK businesses have some form of backup

That leaves roughly one business in eight with no backup at all. Medium-sized businesses do best (95%). If you’re in the 12%, everything else on this page applies to you twice over.

2. 74% back up through a cloud service, and 48% by other means

Cloud backup is now the most common approach. Fewer than half of businesses back up securely by other means, such as an external drive or a separate backup system. The NCSC’s advice for small organisations is to consider both: an online backup and a storage device, “in case one of them is lost or stolen, or if the storage device fails”. That’s the thinking behind the 3-2-1 rule, which we explain in our guide to building a backup strategy.

How likely is something to go wrong?

3. 43% of UK businesses had a cyber breach or attack in the last year

That’s about 612,000 businesses. Smaller businesses aren’t spared: 42% of micro businesses (under 10 staff) and 46% of small businesses reported one.

4. 38% of businesses were hit by phishing

Phishing was by far the most common attack, and the most disruptive one for 69% of businesses that had a breach or attack. A convincing email that leads to a deleted mailbox or a compromised account is far more likely than a dramatic hack, and it’s exactly the kind of thing a good backup recovers from.

5. Ransomware hit 1% of businesses, but 7% of large ones

Ransomware fell from 3% of businesses to 1% this year. It’s rare, but it’s the attack that does the most damage to backups. The NCSC warns that ransomware attacks “may seek to frustrate or prevent effective recovery by destroying backups”, which is why it recommends backups that can’t be deleted or changed by someone who gets into your systems.

6. Only 28% of ransomware victims got all their data back

This one is global, from Veeam’s Data Trust and Resilience Report 2026 (more than 900 senior IT, security and risk leaders). 90% said they were confident they could recover from a cyber incident in time. Yet only 28% of organisations hit by ransomware fully recovered all the affected data, and on average they got back 72% of it. Confidence isn’t the same as a tested restore.

7. Hard drives still fail: 1.36% a year in a large data centre

Not every data loss is an attack. Backblaze, which publishes failure rates for the drives in its data centres, recorded an annualised failure rate of 1.36% across 344,196 drives in 2025. That’s roughly one drive in every 75, each year, in well-cooled, professionally managed conditions. The drive under a desk or in a server cupboard has a harder life.

Could you recover quickly?

8. 12% of businesses took more than a day to get back to normal

After their most disruptive breach or attack, 72% of businesses said recovery took “no time at all” and 15% took less than a day. For the 12% who needed longer, the backup and the plan made the difference.

9. Only a third of businesses have a continuity plan that covers cyber

33% of businesses have a business continuity plan that covers cyber security. Among small businesses (10 to 49 staff) it dropped from 53% to 44% in a year, and among micro businesses it’s 29%. A backup tells you the data exists. A continuity plan tells you how the business keeps working while it comes back.

10. A quarter of businesses have a formal incident response plan

25% of businesses have one, falling to 21% of micro businesses, compared with 57% of medium-sized businesses. Without one, the first hours of an incident are spent deciding who does what, rather than restoring anything.

Three Microsoft 365 numbers worth knowing

Most small businesses now keep their files and email in Microsoft 365, so it helps to know what Microsoft keeps for you by default:

• 93 days: how long deleted files stay in the OneDrive and SharePoint recycle bins for work accounts, unless your administrator has changed it.
• 14 days: how long Exchange Online keeps permanently deleted email by default. An administrator can raise it to 30 days.
• 30 days: how far back you can roll an entire OneDrive with “Restore your OneDrive”.

These are useful safety nets for mistakes. They aren’t a backup: if an account is deleted, an attacker empties the recycle bin, or you notice a problem after the window has closed, the data is gone. Our post on where deleted files go explains more.

What to do with these figures

The pattern is clear. Most businesses have taken the first step and backed up. Far fewer have checked that the backup can be restored, kept a copy an attacker can’t reach, or written down what happens on the bad day.

If you want to close those gaps, our backup and disaster recovery service covers managed backups of your servers, devices and Microsoft 365, offsite copies, regular restore tests and a written recovery plan. If you’d rather start with a quick look at where you stand, the free IT Assessment is a good first step.