Small real estate firms lose more than £125 million annually to cyberattacks, making the sector the UK’s second most financially affected, according to new research.

The study, conducted by money.co.uk, analysed government cyber breach data, which indicates that cyberattacks now cost small and micro UK businesses a combined estimated total of £921.2 million each year.

To help businesses safeguard themselves, the finance experts at money.co.uk have identified the industries most at risk and shared practical tips for small businesses to reduce their exposure to cybercrime.

Estimated cost of cyberattacks on small businesses by sector:

In second place are the administration and real estate sectors. These industries rely heavily on digital invoicing and project management platforms. That dependency can create weak points, exposing firms to invoice fraud, phishing, and ransomware.

Government data shows that 85% of all reported breaches involve phishing attacks, making these firms particularly vulnerable as they juggle multiple stakeholders, subcontractors, and hybrid operations.

Further Study Insight: Nearly half – 48% – of real estate firms experienced a cyber breach in the past year, making it the UK’s third most-targeted sector.

Joe Phelan, money.co.uk business bank accounts specialist, said: “Cyberattacks continue to pose a serious risk, particularly for smaller businesses, as the data shows average costs to micro and small firms have risen by more than 90% in the last 12 months. No business is too small or too large to be a target – all need to take steps to protect themselves against cyberattacks and plan for any incidents.

“That means building cyber awareness into everyday operations by prioritising measures like staff training, regular software updates, and early detection systems that flag unusual activity. It’s also crucial to plan for the potential financial impact of an attack or being forced to close temporarily due to a threat.

“You can be better prepared to cover any unexpected costs or financial losses by building a financial buffer in a high-interest, instant-access business savings account. Having this financial safety net in place allows you to continue operating confidently and have a pot to draw on for investing in better cybersecurity over time as well.

“Using a dedicated business bank account also offers preventative protection. For example, many banks offer business accounts with built-in fraud prevention tools, such as Positive Pay controls, which verify outgoing checks against your company’s list of issued checks. Features like this can help you spot and block fraudulent transfers early, reduce the chance of account takeover, and limit the losses from hacks.

“Proactive planning, both technically and financially, gives businesses the best chance of recovering quickly and minimising the long-term impact of cyber breaches.”