[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXuQ_z8WxFRBjRlBOAQsujy6FSaJqFQEab99sU8Wi9oQ":3},{"article":4,"iocs":44,"watch_terms":53,"solutions":54,"lesson":88},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"4f183f01-573f-442e-b789-9e3cf5db0c3e","Record number of cyber incidents reported to UK privacy regulator","record-number-of-cyber-incidents-reported-to-uk-privacy-regulator-58f4c9","British organizations have reported a record number of cyber incidents to the country’s data protection regulator this year, as cybersecurity firms blame data extortion and artificial intelligence for a surge in attacks.","British organizations have reported a record number of cyber incidents to the UK's Information Commissioner's Office (ICO) this year, with a quarterly high of 1,371 incidents between July and September. Industry sources attribute the surge to data extortion tactics and the increasing use of artificial intelligence in attacks. While ransomware reports to the ICO are generally falling, data from leak sites indicates a rise in ransomware and data-theft extortion, with a significant increase in British organizations being named as victims.","UK organizations report record cyber incidents to ICO, driven by data extortion and AI.","https:\u002F\u002Ftherecord.media\u002Frecord-number-of-cyber-incidents-reported-to-uk-regulator","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fico_wycliffe_house_landscape_95e18c7b55.jpg","2026-11-13T00:00:00+00:00","2026-11-13T13:00:21.830307+00:00",7,[17,20],{"name":18,"type":19},"Sophos","vendor",{"name":21,"type":22},"artificial intelligence","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"23e81061-ab06-449f-8807-cbe4bc305045","UK Data Protection","uk-data-protection",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[45,49,51],{"type":46,"value":47,"context":48},"malware","Qilin","Ransomware group driving extortion incidents",{"type":46,"value":50,"context":48},"The Gentlemen",{"type":46,"value":52,"context":48},"n0n",[18],{"controls":55,"vendors":84},[56],{"slug":27,"name":57,"problem":58,"products":59},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[85],{"slug":61,"name":62,"logo_path":63,"roles":86},[87],"reported_by",{"slug":89,"title":90,"body":91,"framework_refs":92,"framework_notes":98},"record-uk-cyber-incident-reports-highlight-data-extortion-surge","Record UK Cyber Incident Reports Highlight Data Extortion Surge","British organisations reported a record 1,371 cyber incidents to the ICO in a single quarter, driven by data extortion tactics and AI-enhanced attacks. The surge suggests that attackers are increasingly prioritising data theft over encryption, knowing that regulatory reporting obligations and reputational damage create powerful leverage. Many organisations may be under-reporting to regulators while still appearing on ransomware leak sites, indicating a gap between actual compromise rates and formal disclosure. This matters because under-reporting delays sector-wide threat intelligence sharing and leaves other organisations exposed to the same attack vectors.",[93,94,95,96,97],"GDPR Article 33","NIS2 Article 21(2)(b)","NIST CSF 2.0 RS.AN-03: Incident Analysis","CIS Control 3: Data Protection (v8)","ISO\u002FIEC 27001:2022 A.5.24: Information security incident management planning and preparation",{"GDPR Article 33":99,"NIS2 Article 21(2)(b)":100,"CIS Control 3: Data Protection (v8)":101,"NIST CSF 2.0 RS.AN-03: Incident Analysis":102,"ISO\u002FIEC 27001:2022 A.5.24: Information security incident management planning and preparation":103},"Article 33 requires controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach, directly driving the ICO reporting obligation at the centre of this incident surge.","This point mandates incident handling procedures, which organisations evidently lack or underutilise given the gap between leak-site appearances and formal regulatory reports.","CIS Control 3 requires organisations to inventory, classify, and protect sensitive data, which directly limits the impact of data-theft extortion by reducing the volume of exfiltrable high-value data.","Structured incident analysis procedures would help organisations quickly determine whether a data-theft extortion event constitutes a notifiable breach, closing the gap between actual and reported incidents.","This control requires pre-planned incident management procedures that would ensure organisations recognise, respond to, and report data extortion events consistently and within regulatory deadlines."]