UK Financial Services Face £1bn Cybersecurity Loss as 97% of Firms Hit by Attacks

UK financial services firms lost an estimated £1.01 billion to cyberattacks over the last year, despite maintaining high levels of security maturity. With 97% of organisations experiencing at least one breach, the data highlights a critical gap between defensive investment and operational resilience that fintech leaders must address to prevent significant customer churn and financial damage.

What was announced

The 2026 ESET UK Financial Services Security Report, which surveyed 500 small-to-large UK financial services firms, reveals a pervasive threat landscape where 62% of organisations faced multiple cyberattacks in the past twelve months. The financial impact is compounded by recovery times; on average, it takes seven days for a firm to restore critical business operations following a security incident. This downtime, coupled with the direct costs of breaches, has led to a total industry loss exceeding £1 billion.

A significant portion of these losses remains unrecovered despite the prevalence of cyber insurance. The report indicates that firms are paying for approximately 44% of incident costs out-of-pocket, potentially leaving the UK financial services sector to absorb up to £456 million in annual losses. Consumer sentiment adds further pressure, as only 11% of customers stated they would continue using their provider as normal after a major data breach.

The survey also identified internal vulnerabilities. Nearly six-in-ten respondents (58%) admitted it is possible their organisation has already been breached without discovery. The primary obstacles to improving security posture include a persistent talent shortage (38%), the difficulty of maintaining 24/7/365 security operations (33%), and the ongoing challenge of securing legacy technology (32%). These gaps are increasingly exploited by threat actors using AI-powered tools to bypass traditional defenses.

The companies involved

ESET is a global cybersecurity firm with a significant presence in the United Kingdom, where it provides threat intelligence and security solutions to various sectors, including financial services. The company has established itself as a key player in the Managed Detection and Response (MDR) market, often partnering with insurance and risk management firms to integrate security software with financial protection.

SaaScada is a UK-headquartered global fintech company that provides a cloud-native core banking engine. The platform is designed to enable financial institutions to build and launch innovative products rapidly while maintaining a secure, scalable infrastructure. By offering a flexible alternative to traditional legacy systems, SaaScada helps firms modernise their technology stacks, which is a critical factor in addressing the legacy security gaps identified in recent industry research. The company’s leadership, including co-founder Steve Round, frequently provides insights into the intersection of banking technology and operational risk, reflecting the firm's position at the heart of the UK's digital banking ecosystem.

What FF News has reported before

FF News has closely followed the strategic moves of both ESET and SaaScada as they navigate the evolving security and fintech landscapes. In September 2026, we covered how Acrisure UK and ESET Launch Cyber Insurance Partnership to Combat Evolving Digital Threats, a move aimed at bridging the gap between technical defense and financial recovery. This followed the news that ESET Partners with Cysurance to Launch Integrated Cyber Warranty for MDR Clients. SaaScada has also been active in expanding its ecosystem, with reports on how SaaScada and Zumo Launch Ready-Built Crypto Route for UK Banks and Wealth Managers and news that Pace FS Selects SaaScada to Meet Growing Demand for Real-time European Payments.

What this means

The revelation that UK financial firms are absorbing nearly half a billion pounds in uncompensated cyber losses suggests that the current insurance model is failing to keep pace with the reality of digital crime. While "cyber maturity" is often cited as a defense, the 97% attack rate proves that maturity does not equal immunity. The industry is reaching a tipping point where the cost of legacy technology is no longer just an operational drag but a direct financial liability. As AI-powered threats lower the barrier for sophisticated attacks, firms that cannot solve the talent shortage or move away from fragile legacy systems will likely see their customer trust—and their balance sheets—eroded beyond repair.