“The total annual cost of cyber-attacks in the UK is £15 billion.” — Al Carns. Our verdict: Mostly True.
Al Carns, a former UK defence minister, made the claim at Chatham House on 26 October 2026, as reported by Tech Digest.
Our verdict
Mostly True
The claim is broadly accurate. Official government research puts the annual cost of cyber-attacks in the UK at £14.7 billion, which is close enough to £15 billion to support the figure.
What we found
We rated this claim mostly true. The £15 billion figure matches official UK government research, published by the government in November 2025, which estimated the annual cost of cyber-attacks at £14.7 billion. A government press release from the same day described the cost as "almost £15 billion". Al Carns, a former defence minister, used the £15 billion figure in October 2026. The small gap between £14.7 billion and £15 billion is a rounding difference, not a contradiction. However, the £15 billion refers to the latest available research, not a fresh measurement for 2026, and no source confirms a total specifically for that year.
The evidence
2 of 5 sources support the claim; none contradict it.
- Background
Al Carns said at Chatham House that "we know there is £15bn of cyber-attacks" in the UK, and also confirmed the Jaguar Land Rover cyber-attack was state-sponsored. [1]
- Supports the claim
An official government press release cites research stating the annual cost of cyber-attacks is almost £15 billion. [2]
- Supports the claim
Official government-published research estimates the annual cost of cyber-attacks in the UK at £14.7 billion. [3]
- Background
A government-commissioned study by Detica and the Office of Cyber Security and Information Assurance was carried out to quantify the cost of cyber crime to the UK economy, including IP theft and industrial espionage. [4]
- Background
A 2022 government review discusses cyber security incentives and regulation and references breach rates among UK businesses, but does not put a total annual cost on cyber-attacks. [5]
What we could not confirm
- No source confirms a total annual cost figure specifically for 2026. The £15 billion figure reflects the latest available research, likely from 2024 or 2025.
- Al Carns' statement was clarified as not being based on an official Ministry of Defence assessment.
How we checked
We looked at official UK government research and press releases on the economic cost of cyber-attacks, along with the original report of Al Carns' statement and earlier government work on cyber crime costs. We reviewed 5 relevant sources.
Sources
- [1]Tech Digest · Former minister confirms Jaguar Land Rover cyber-attack was state sponsored · October 1, 2026
- [2]gov.uk · Tough new laws to strengthen the UK's defences against cyber attacks on NHS, transport and energy · November 12, 2025
- [3]gov.uk · Independent research on the economic impact of cyber attacks on the UK · November 12, 2025
- [4]Detica in partnership with the Office of Cyber Security and Information Assurance (OCSIA), Cabinet Office · The Cost of Cyber Crime - Summary Final
- [5]gov.uk · 2022 cyber security incentives and regulation review · January 19, 2022
- [6]Photo: Sgt Jimmy Wise / Wikimedia Commons, OGL 3
Have evidence we missed?
If you know of a source that confirms or contradicts this claim, send us the link. We review every submission and update fact checks when new evidence changes the picture.
Measured Take updates fact checks when new evidence emerges. Corrections are noted on the page.
All fact checks