More than 25% of UK businesses hit by cyber-attack in past year

02 Jul 2025

More than one in four UK businesses have been the victim of a cyber-attack in the last year, with many risking 'sleepwalking' into disruption, according to a new report.

The survey, which was conducted by the Royal Institution of Chartered Surveyors (RICS), found that 27% of companies said their building had suffered a cyber-attack in the last 12 months, up from 16% a year ago.

Almost three-quarters of business leaders believe that a cybersecurity incident will disrupt their business in the next 12 to 24 months, the survey found.

The paper identifies operational technology such as building management systems, CCTV networks, Internet of Things (IoT) devices and access control systems as risk areas.

It also notes concerns that some buildings use outdated operating systems (OS). A building opened as recently as 2013 could conceivably use Windows 7; an OS that hasn't received security updates from Microsoft in over five years.

Paul Bagust, Head of Property Practice at the RICS, said: 'Buildings are no longer just bricks and mortar, they have evolved into smart, interconnected digital environments embracing increasingly sophisticated and ever-evolving technologies to enhance occupier experience.

'It is inconceivable to imagine a world where technology will not continue to pose a growing risk to a building's operation, and it is equally impossible to consider that the management of digital risks will not be needed as an imperative measure to safeguard the future of a building and prevent systems from being compromised.

'Failure to identify these growing digital challenges and incorporate security countermeasures risks businesses sleepwalking into cyber-attacks.'