Loading today’s stories
Security1 distinct publisher2 min readPublished
City of London Police recorded a 417% rise in account-hack losses to £6.3m in the year to March. The arithmetic underneath it shows the average loss per victim halving as small cases got recorded for the first time.
The Watch · Security desk
product
Reform UK bets EU adequacy survives scrapping the ICO's multi-million-pound fines1 distinct publisher
security
Intruders took donor emails from two Russian charities through a Stripe-WooCommerce integration1 distinct publisher
build
The ICO fines what you cannot prove: Article 32 makes encryption and erasure an engineering liability1 distinct publisher
security
DGFiP breach started with a borrowed identity, not a bug6 distinct publishers
Compiled by The WatchSomething wrong?How this is made
Divide the money by the people and the trend reverses. £6.3m spread across 2,325 loss-reporting victims is about £2,710 each [1]. The year before, £1.2m across 226 victims was about £5,310 [2]. The average reported account-hack loss halved while the total more than quintupled [3], which is what happens when small cases enter a system that was not capturing them [6].
The published percentages also show which figures are firm. 226 to 2,325 reproduces the 929% police quote exactly; £1.2m to £6.3m works out at 425%, not the 417% stated, so the loss totals are rounded and the victim counts are not [8].
The 2025-26 year is not a clean baseline either. Using the second-half share police describe, 92% of 2,325 is 2,139 loss reports in six months, and a full year at that rate would be roughly 4,278, about 84% above the total actually recorded [4]. The first year measured end to end on the new platform is 2026-27.
One division tells you how the averages are built. £14.3m over 64,608 cyber-dependent reports is £221 [5], which is the £220 average per victim the assessment publishes, so that figure divides losses across every report rather than across the reports that carried a loss. On the account-hacking side, 2,325 of 44,355 reports came with a recorded financial loss, or 5.2% [6].
The assessment is explicit about where the rest of the money goes. A hack and the fraud it enables can be recorded separately, and a victim who never learns the email account was compromised reports only the fraud [10]. Those losses land in investment scams, payment diversion, online shopping fraud and bank-account fraud, categories that together recorded £3.2bn, up more than a quarter [11]. The whole cyber-dependent loss figure is 0.45% of that [7].
Ransomware sits outside all of this. Report Fraud logged 323 reports against 430 the year before [12], and police decline to read the drop as fewer attacks because ransomware reaches them through several channels [13]. Proposals for mandatory reporting of attacks and payments remain stalled [14], so the series continues to measure reporting habits. Everything in the assessment rests on voluntary self-reporting and, police say, is likely a small fraction of real losses [17].
The 417% rise does not describe attacker behaviour; it is the first evidence of what Action Fraud was missing in collection [5]. What survives for planning purposes is 44,355 account-hack reports, 5.2% of them carrying a recorded loss, from a year in which the new service ran for half the time [6].
Ranked by verification strength, evidence, and original report placement.
In its first annual assessment, published Friday, the City of London Police said reported losses tied to hacked email, social media and other online accounts in Britain rose 417% over the last financial year.
Victims reported losing £6.3 million to account hacks in the year ending March 31, up from £1.2 million a year earlier.
The number of victims reporting a financial loss from account hacks rose from 226 to 2,325, an increase of 929%.
Police said 92% of the account-hacking reports involving a financial loss were recorded in the second half of the financial year, directly overlapping the move to the new platform.
Report Fraud, the national service that replaced the widely criticized Action Fraud system, formally launched in January; onlookers widely believed Action Fraud's shortcomings suppressed the total number of victim-reported crimes.
Police cautioned that some of the increase reflects more incidents being identified and recorded rather than necessarily matching a real-world rise in offences, making direct comparison with the previous year less straightforward.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · September 4, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One document, internally consistent
The £6.3m, the 929% jump in loss-reporting victims and the 62% SME share all come from a single document — City of London Police's first annual assessment — relayed by Recorded Future News with no outside statistician or rival dataset. The nearest adjacent series in the story, the Information Commissioner's Office's 452 ransomware-related breaches, counts data-protection breaches rather than crime reports, and the reporting says so plainly. What lifts the grade above a single-source floor is that the figures check out against each other: 2,325 against 226 reproduces the published 929% exactly, and £6.3m against £1.2m gives 425% where 417% is stated, which reads as rounded money rather than a bad count.
Live nationally, carrying real volume
Report Fraud is not a pilot: 64,608 cyber-dependent reports in its first year, 44,355 of them account hacking, 2,271 from organisations. The timing is the strongest uptake signal in the assessment — 92% of loss-bearing account-hack reports arrived in the second half, straight after the January launch. Annualise that second-half rate and the year would have carried roughly 4,278 loss-reporting victims rather than 2,325, which is a rough measure of what the old service was holding back.
The percentage outruns the caseload
417% is honest arithmetic and a poor description of the crime. Average reported loss per loss-reporting victim fell from about £5,310 to about £2,710 while the total more than quintupled, which is the signature of small cases being recorded for the first time rather than bigger thefts. City of London Police said as much and Recorded Future News put the caveat in its opening sentence, so the overstatement risk lives in how the percentage behaves once it is quoted elsewhere — and in the £14.3m cyber-dependent figure being 0.45% of the £3.2bn the same service recorded across fraud categories.
The platform's owner keeps its own scorecard
The force that built Report Fraud is also the only source of the numbers showing Report Fraud working, and in first-year assessments more reports is the success metric. The same document explains away its one falling figure — 323 ransomware reports, down 25% — as underreporting across multiple channels, while mandatory ransomware reporting sits stalled after last year's consultation; the police have a standing interest in that argument landing. None of this makes the counts wrong, and Recorded Future News flags the reporting-driven caveats up front rather than burying them.
Firm on reports, thin on offences
What was filed is documented precisely and hangs together: report counts, loss totals, the SME share, and percentages that mostly reproduce from their own inputs. What happened in the world is a different question, and voluntary self-reporting cannot answer it — both the force and Recorded Future News call these figures a small fraction of the real total, and the assessment's own recording rule sends losses from hacked accounts into the fraud categories whenever the victim never learns of the compromise. High confidence in the paperwork, low in any inference about UK account-takeover volumes.