Human Error, Not Hackers, Behind Most UK Data Breaches
When a data breach makes headlines, the public imagination often turns to hoodie-wearing hackers breaking through firewalls in the dead of night. The reality, according to a growing body of evidence from UK regulators and researchers, is far more mundane—and far more difficult to fix. The majority of data breaches reported to the UK’s Information Commissioner’s Office (ICO) are not the work of sophisticated cybercriminals. They are caused by ordinary people making ordinary mistakes.
The Numbers Tell a Clear Story
The ICO’s own data reveals a striking pattern. In the 2025/26 reporting year, the office received 17,431 data breach reports, a sharp increase from 12,412 the previous year. The most common type of incident? Not ransomware. Not zero-day exploits. It was personal information being sent to the wrong recipient via email, mail, or fax.
This pattern holds across sectors. Analysis of ICO data from the legal sector found that 39 percent of all data breaches were attributed to human error—failures like forgetting to redact documents, neglecting to use BCC, or altering data incorrectly. Another 37 percent involved sharing information with the wrong person. Together, that’s three-quarters of incidents rooted in everyday mistakes, not malicious attacks.
A study of 215 school-related data breaches between January 2022 and August 2024 found that only 5 percent involved skilled attackers intentionally hacking systems. The rest? Weak data protection practices (23 percent), staff sending data to personal devices (20 percent), and system misconfigurations (17 percent).
What “Human Error” Actually Means
The term “human error” is often used as a catch-all, but it obscures more than it reveals. As one security analyst argues, it’s fundamentally “low definition”—a concept that neglects context, design flaws, and systemic issues.
Consider the examples that dominate UK breach statistics:
Wrong recipient breaches occur when someone sends an email to the wrong person, forgets to use BCC, or fails to redact a document properly. In 2025, reports of data emailed to the wrong recipient hit their highest yearly count, with 70.1 percent of these reported within the required 72-hour window.
Misconfiguration incidents happen when systems like SharePoint have improperly set permissions, or when devices are left logged in and unattended. In schools, this accounted for 17 percent of breaches.
Lost devices and paperwork contribute significantly to breach figures. Losing a laptop, a phone, or even a folder of printed documents containing personal data is a persistent problem.
These are not failures of ignorance. They are failures of process, attention, and—crucially—organisational design.
Why Blaming People Misses the Point
The security industry has a habit of calling humans the “weakest link.” But this framing is both unhelpful and inaccurate. As one analyst puts it, expecting people to spot homoglyphs (lookalike characters used in phishing domains) or never make a mistake with a complex email chain is “over-simplistic”.
The real lesson from UK breach data is that systems and processes are failing people, not the other way around. When a teacher leaves a device logged in, the problem isn’t just that teacher. It’s that the system allowed unattended access. When staff send data to personal devices, the problem isn’t just individual behaviour. It’s that secure, convenient alternatives weren’t provided.
Research on human factors in cybersecurity consistently finds that organisational culture—not individual competence—shapes security outcomes. When cybersecurity is treated as a collective responsibility rather than an individual burden, breach rates improve.
The Regulatory Context
The ICO has signalled that it will take a harder line on organisations that fail to implement appropriate technical and organisational measures. The agency issued eight fines totalling over £32 million in 2025/26, a dramatic increase from two fines worth around £4 million the previous year. The average monetary penalty has quadrupled since 2023, rising from just over £675,000 to almost £3.2 million.
Crucially, the ICO’s enforcement approach places significant weight on how well organisations demonstrate accountability. As one privacy expert notes, “The size of a fine isn’t driven by the incident alone. The ICO places a significant amount of weight on how well accountability is demonstrated”.
This matters because human error breaches are often symptoms of inadequate investment in training, process design, and security culture. An organisation that blames individuals for mistakes without addressing the systems that enabled them is likely to face both repeated breaches and escalating regulatory consequences.
What Organisations Can Actually Do
The UK government’s Cyber Security Breaches Survey 2025/26 found that 43 percent of businesses experienced a breach or cyber attack in the past year. With such widespread exposure, the question is not whether organisations will face incidents, but how they prepare for and respond to them.
Focus on process design, not just awareness training. The 2022 change that disabled Office VBA macros by default led to a sharp decrease in malicious actors targeting humans through that vector. No amount of training achieved what a single design decision accomplished.
Implement technical controls that prevent mistakes. Recipient confirmation prompts, send delays, BCC defaults, and redaction reviews can intercept the most common error types before they become breaches. Multi-factor authentication limits the damage when credentials are compromised.
Build a culture where reporting is safe. The most dangerous breach is the one that goes unreported. Organisations that punish mistakes discourage the transparency needed to contain incidents quickly.
Understand your data. Knowing what personal data you hold, why you hold it, and where it flows is essential—not just for compliance, but for managing the impact when something goes wrong.
The Bottom Line
The UK’s data breach statistics paint a consistent picture: the greatest threat to personal data is not a shadowy hacker collective. It is the everyday operations of organisations that have not designed their systems, processes, and cultures to account for human fallibility. Until that changes, the breach reports will keep coming—and the ICO will keep taking notice.
Frequently Asked Questions
What percentage of UK data breaches are caused by human error?
The exact figure varies by sector and how “human error” is defined, but analysis of ICO data consistently shows that the majority of breaches stem from non-malicious mistakes. In the legal sector, 39 percent of breaches were directly attributed to human error, with another 37 percent involving data shared with the wrong person. In schools, only 5 percent of breaches involved skilled attackers.
What is the most common type of data breach in the UK?
The most common incident type reported to the ICO involves personal information being sent to the wrong recipient by email, mail, or fax. In 2025, wrong-recipient email breaches reached their highest yearly count.
Does the ICO fine organisations for human error breaches?
Yes. The ICO can issue significant fines for breaches that result from inadequate technical or organisational measures, including those caused by human error. In 2025/26, the ICO issued eight fines totalling over £32 million. The agency considers how well organisations demonstrate accountability when determining penalties.
What can organisations do to reduce human error breaches?
Practical measures include implementing technical safeguards like recipient confirmation and send delays for email, using BCC defaults, requiring multi-factor authentication, conducting regular redaction reviews, and fostering a culture where employees feel safe reporting mistakes. Process design changes are often more effective than awareness training alone.
Is human error more common than hacking in UK data breaches?
For the majority of reported breaches, yes. While high-profile cyber attacks and ransomware incidents dominate news coverage, the routine reports to the ICO are overwhelmingly dominated by non-malicious errors—wrong recipients, misconfigurations, lost devices, and failures to redact or use BCC.
