iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A report by Labour MP Graeme Downie estimates that Russian hostile activity costs the UK economy £2bn–£2.5bn a year. The figure is an indicative working estimate, not an official government accounting or a tax collected by the state. The headline’s $3.3bn is an approximate conversion of the upper end of the report’s pound-denominated range; the report itself gives its estimate in pounds.
It covers more than confirmed cyberattack losses: the calculation brings together identified incident costs, modeled cyber-loss estimates and potential exposure from threats to infrastructure. Those evidence types have different levels of certainty, and the report warns that attribution and loss data are incomplete.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Politics UK | $51.99 | Buy on Amazon |
| 2 |
|
UK POLITICS ANNUAL UPDATE 2026 | $13.60 | Buy on Amazon |
| 3 |
|
Politics UK | $47.94 | Buy on Amazon |
| 4 |
|
The Rise of Reform UK: How a Political Movement Changed Britain | $13.32 | Buy on Amazon |
| 5 |
|
The Socialist Manifesto: The Case for Radical Politics in an Era of Extreme Inequality | $10.62 | Buy on Amazon |
What is the “Putin Tax”?
“The Putin Tax” is Downie’s term for economic costs borne by UK taxpayers, businesses and public services as a result of Russian hostile activity. The report, The Putin Tax: Estimating the Economic Cost of Russian Hostile Activity Against the United Kingdom, is dated October 2026.
It is not a formal tax or a government bill. The term groups together costs such as incident response, business disruption, resilience and security measures, and possible damage to critical infrastructure. The report says the UK lacks a consistent framework for measuring this burden across the economy.
#1 Best Overall
Its use of “Russian hostile activity” is broader than attacks formally attributed to the Russian state. It includes Russia-linked criminal or proxy actors where the report considers a connection to the wider threat environment credible, while acknowledging that the relationship between criminal groups and the state is not always clear.
How much do Russian cyberattacks cost the UK?
Downie’s report gives a headline estimate of £2bn–£2.5bn annually for Russian hostile activity overall. It does not establish that cyberattacks alone cost that amount: the estimate also encompasses physical hostile activity and potential infrastructure exposure.
The report’s three-case baseline is approximately £1.61bn–£2.11bn. It is described as “a floor, not a ceiling,” but it is not a verified total of losses from state-directed Russian attacks. The cases differ in the strength of attribution and in what their cost figures measure.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
| Case | Cost cited in the report | What the figure represents and attribution |
|---|---|---|
| Royal Mail parent company, following the January 2023 LockBit attack | Around £10m | Remediation and resilience costs disclosed by the company. The report includes this in its Russia-related threat assessment; it should not be read as proof that the Russian state directed the attack. |
| Leyton arson attack, March 2024 | Approximately £1m | Direct damage, according to Counter Terrorism Police. The report includes this physical attack in its assessment of hostile activity. |
| Jaguar Land Rover cyberattack, 2025 | Estimated £1.6bn–£2.1bn | Broader economic losses estimated by Downie’s report. The report says investigators cited by The New York Times concluded the attack originated from a Russia-linked group, but the UK government had not attributed it to Russia. |
The combined range is dominated by the JLR estimate. That estimate concerns broader economic losses, not simply a direct bill paid by the company. The three cases therefore should not be treated as three equally measured or definitively state-attributed losses.
How did the report calculate £2bn–£2.5bn a year?
The report combines evidence layers rather than adding up a complete set of audited incident costs. Its components are best read by measurement status: identified losses, extrapolations and exposure. They are not interchangeable, and the headline estimate should not be mistaken for a sum of independently verified Russian losses.
Identified losses from three cases
The Royal Mail, Leyton and JLR figures produce the report’s approximate £1.61bn–£2.11bn three-case baseline. It offers concrete examples of costs, but the cases include different forms of harm and different levels of attribution certainty.
Rank #3
A rough calculation from Russia-linked cyber incidents
CyberCube data cited in the report identified more than 300 Russia-linked cyber incidents affecting UK companies since 2022. Downie applies the UK government’s cited average cost of almost £195,000 for a significant cyber incident to 300 cases, producing a rough baseline of about £58.5m. This is a calculation using an average, not a measured loss total for those specific incidents.
Recommended Free Tools
The report says the incident count likely understates the scale: some attacks lack reliable attribution, many companies do not report incidents, and the CyberCube dataset excluded businesses not headquartered in the UK.
Scenarios based on economy-wide cyber losses
Department for Science, Innovation and Technology research is reported as estimating annual cyber losses to UK businesses at £14.7bn, or about 0.5% of GDP. Downie models what different Russia-linked shares of that broader total would imply:
| Assumed Russia-linked share | Implied annual amount | Status |
|---|---|---|
| 10% | £1.47bn | Scenario in Downie’s report, not an established finding about Russia’s share of UK cyber losses. |
| 15% | £2.21bn | Scenario in Downie’s report, not an established finding about Russia’s share of UK cyber losses. |
| 20% | £2.94bn | Scenario in Downie’s report, not an established finding about Russia’s share of UK cyber losses. |
Potential subsea-cable exposure
The report gives an estimated £250m–£500m in annual subsea-cable exposure. It derives this range by applying observed incident rates and repair costs to infrastructure relevant to the UK. It labels the figure exposure, not measured annual loss; repair costs alone also leave out the economic effects of outages.
Most subsea-cable damage is caused by poor seamanship or equipment failure rather than hostile action, the report notes. The exposure range is therefore not evidence that Russia causes that amount of damage each year.
Is the $3.3bn figure confirmed?
No. The report’s own working range is £2bn–£2.5bn a year. The $3.3bn in the headline is an approximate conversion of the upper end, not a second estimate or a government-confirmed figure. Because the report does not present its headline estimate in dollars, readers should use the pound range when describing its finding.
Best Value
Nor does the estimate mean the UK has recorded £2bn–£2.5bn in confirmed losses from Russian cyberattacks. It draws on evidence with varying certainty, including an attack the UK government had not attributed to Russia, modeled shares of economy-wide cyber losses, and infrastructure exposure rather than measured damage.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What does the report say is known—and uncertain?
Downie’s report is an independent, desk-based estimate based principally on public information. It says the work had no access to classified intelligence, a dedicated analytical team or a research budget, and that estimates may change as further data becomes available.
- Attribution is not uniform. “Russian state-attributed,” “Russia-linked” and “Russian hostile activity” describe different levels or kinds of connection. The report does not establish that every included incident was ordered by the Russian government.
- Some figures are modeled. The £58.5m cyber baseline applies an average incident cost to 300 incidents; the £1.47bn–£2.94bn figures apply assumed Russia-linked shares to economy-wide losses.
- Some figures describe exposure, not loss. The subsea-cable range is a potential annual exposure, and the report says most cable damage is not hostile.
- Under-reporting complicates measurement. Companies may not report attacks, and incidents may not have reliable attribution. This makes a complete total difficult to establish.
The report also cites the NCSC chief executive’s figure that 75% of significant cyber incidents affecting critical national infrastructure are linked to hostile states. That figure concerns hostile states generally, not Russia alone.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What does the report recommend?
Downie argues that fragmented information makes the economic burden hard to assess consistently. The report recommends:
- An annual UK government report to Parliament estimating the costs of hostile activity by foreign states and attributing activity to states where possible.
- Annual NCSC assessments of significant hostile-state cyber activity, including attribution and economic impacts where feasible.
- A Ministry of Defence methodology for assessing the costs of physical hostile activity.
- A public awareness campaign on hostile-state threats, cyber resilience and preparedness.
The report says these recommendations do not specifically call for additional government spending.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
