When do businesses report cybercrime? Findings from a UK study

Steven Kemp, David Buil-Gil, Fernando Miró-Llinares, Nicholas Lord

Research output: Contribution to journalArticlepeer-review

459 Downloads (Pure)


Although it is known that businesses report cybercrime to public authorities at a low rate, and this hinders prevention strategies, there is a lack of research on companies’ decisions to report cyber victimisation. This paper analyses the UK Cyber Security Breaches Survey to explore factors associated with cybercrime reporting by businesses. Results indicate that the type of cybercrime is relevant to the reporting decision, and that the likelihood of reporting increases when cybersecurity incidents generate negative impacts and when the company places high priority on cybersecurity. However, we find no association between having cybersecurity insurance and reporting. Finally, while having outsourced cybersecurity management is associated with reporting to anyone outside the organisation but not to public authorities, in-house cybersecurity teams seem more inclined to report to public authorities. Findings are discussed in relation to the role of the private cybersecurity sector and the criminal justice system in combatting cybercrime.
Original languageEnglish
Pages (from-to)468-489
Number of pages22
JournalCriminology and Criminal Justice
Issue number3
Early online date5 Dec 2021
Publication statusPublished - 5 Dec 2021


  • Corporate
  • cybersecurity
  • dark figure of crime
  • financial crime
  • organisations


Dive into the research topics of 'When do businesses report cybercrime? Findings from a UK study'. Together they form a unique fingerprint.

Cite this