Summary
- Sharp UK's security operations analysis covered 99 investigated incidents and 10,516 alerts between August 2025 and September 2026.
- Compromised accounts were involved in 71% of those incidents; 43% of account takeover attempts occurred outside business hours.
- The findings relate to Sharp's monitored environments and cannot establish prevalence or initial compromise methods across UK businesses.
Compromised accounts were involved in 71% of the cybersecurity incidents examined by Sharp UK, according to research drawn from the company’s own security operations activity.
The analysis by Sharp UK covered 99 investigated incidents and 10,516 security alerts between August 2025 and September 2026. These are cases and alerts observed within Sharp’s monitored environments, rather than a nationally representative sample of attacks against UK businesses.
Sharp also reported that 43% of account takeover attempts occurred outside business hours, with alerts peaking between 3pm and 7pm. The alert and incident measures have different denominators and should not be treated as interchangeable.
The company’s public research summary describes 71% of incidents as involving compromised accounts. Although accompanying commentary discusses email compromise, the published summary does not establish that compromised email accounts were the initial access route in 71% of cases.
The findings were included in Sharp’s Cyber Security Insights Report 2026, publicly available from 13 October. They offer evidence about patterns within the company’s investigations, not a new measurement of national cybercrime prevalence.
Identity exposure affects more than a mailbox
Business email accounts contain relationships with customers, suppliers, colleagues, and external advisers. Unauthorised access can expose messages, attached files, and sensitive operational information without requiring the attacker to deploy ransomware.
An intruder with account access may be able to follow existing conversations, identify payment processes, or impersonate a familiar contact. These possibilities depend on the permissions available and do not establish that every incident in Sharp’s dataset involved theft, fraud, or subsequent movement into other systems.
Only 2% of the 99 investigated incidents were classified as ransomware-related. That proportion describes this particular operational dataset and should not be read as an estimate of ransomware prevalence across the UK.
The findings put emphasis on account protection and the ability to recognise unauthorised activity, including when logins are technically valid but unusual in their timing, location, or behaviour.
Response coverage extends beyond office hours
Forty-three per cent of account takeover attempts occurred outside ordinary business hours within the activity Sharp analysed. An intrusion detected late on Friday may remain active for longer if a business lacks monitoring and escalation arrangements over the weekend.
The greatest number of related alerts appeared between 3pm and 7pm, a period covering both normal working activity and the transition into evening operations for many organisations. Detection policies built around a single overnight window would therefore miss other potentially relevant patterns.
Prompt revocation of compromised sessions and credentials can restrict further access, but the response also requires identifying whether an attacker accessed files, modified settings, or contacted third parties before containment.
Sharp’s data does not establish how long individual intrusions remained undetected. Its time-of-day findings indicate when the monitored attempts occurred, rather than measuring their average duration or ultimate impact.
Supplier relationships create secondary exposure
Account compromise can also undermine relationships between organisations. A message sent from a legitimate supplier mailbox may be more persuasive than communication from an unknown address, particularly when it refers to established orders, invoices, or project details.
Similarly, external partners may hold authorised access to customer systems for support and administration. When those accounts are compromised, their permissions can make the incident relevant to organisations that did not suffer the original intrusion.
Tyron Raubenheimer, Head of Security and Cloud Technologies at Sharp UK, said: “No business operates in isolation. Every organisation is part of an interconnected ecosystem of suppliers, partners and customers built on trust, and cyber criminals are increasingly exploiting those trusted relationships as a route into their targets.”
He recommended multifactor authentication, regular reviews of third-party access, monitoring for abnormal activity, and established processes for verifying sensitive requests.
The UK government’s Cyber Security Breaches Survey 2025/2026 found that only 15% of businesses reviewed the cybersecurity risks associated with immediate suppliers, and 6% examined their wider supply chain. Those figures come from a separate government survey and should not be conflated with Sharp’s 99 incident investigations.
Access controls and incident coordination
Restricted permissions, conditional access rules, and regular removal of unnecessary supplier accounts can reduce exposure, while independent checks on sensitive financial requests can limit dependence on the apparent legitimacy of an email address.
Incident procedures also need a way to inform affected customers and partners when a trusted account is compromised. Notifications may allow recipients to identify suspicious communications or revoke shared access before additional activity occurs.
Sharp’s Cyber Security Insights Report 2026 describes the investigated activity. Its separate supply chain guidance expands on controls for connected businesses.
The reported percentages are meaningful within Sharp’s monitored environments but cannot establish a national trend or prove that account compromise always originated through email. The evidence points instead to the practical demands of monitoring trusted identities and managing their connections to other organisations.
