Information on reported cyberattacks - May 2023

There were 383 firm notifications made to the FCA between 1 January 2019 to 31 December 2022 in which the root cause was identified as a Cyber Attack.

Please see Table 1 below for a yearly breakdown.

Whilst we may hold data in relation to some incidents reported to us, we do not systematically record this data in a way which would enable us to fully respond to this part of your request.

Additionally, to extract potentially relevant data that we may hold would require us to exercise skill and judgment in order to quantify the relevant financial values. This exercise would amount to the creation of new data, which we are not required to do under FOIA.

Please see Table 2 below, which provides a breakdown (by year and sector) of incidents reported by firms between 1 January 2019 and 31 December 2022, and in which the root cause was identified as a Cyber Attack.

Please note that:

1. This breakdown is based on the date of notification to the FCA and not the date on which the incident took place;
2. The below sectors are defined in our 2019 ‘Sector Views’ available on our website; and
3. This data is correct as at 5 April 2023 and is subject to change.

Table 2