In 2024, 43% of UK businesses reported experiencing a cyber security breach in the past year – a pretty alarming figure.
Then in 2025, data breaches involving big names like Marks & Spencer and Co-op impacted thousands of shoppers and made headlines nationwide. Unsurprisingly, three out of four people now feel their data isn’t safe online.
But it’s not just hackers or cyber incidents we should pay attention to.
New analysis by Officeology reveals that there were 1,820 paperwork-related data breaches reported to the ICO in 2025 alone.
Over the last six years, there have been 11,141 non-cyber data breaches due to paperwork mishandling, yet less than 5% (502) have resulted in investigations:
In 2025, only 12 of these breaches were investigated – less than 1%.
What is an offline data breach?
An offline data breach is a non-cyber security incident where sensitive or personal information is physically accessed, lost, stolen or intercepted without permission.
Instead of targeting online systems, these breaches happen in the real world, often involving paper documents, laptops or external data storage devices.
Our data focuses specifically on paperwork-related offline breaches.
Examples include:
- Stolen files or documents
- Sending paperwork to the wrong address
- Leaving sensitive information unattended or visible to others
- Losing physical copies containing sensitive or personal information
Who is affected by paperwork-related data breaches?
While data breaches often target organisations and large businesses, they can impact a wide range of people. On average, 208 individuals are affected by a single data breach involving paperwork mishandling.
This means an estimated 378,560 people could have been impacted by paperwork-related data breaches in 2025.
Our research found that employees were the most likely to experience data loss or theft in 2025, with 330 cases, accounting for 1 in 5 incidents.
Roughly 28,050 employees may have had their personal data lost or stolen due to poor data and document management in 2025.
Other commonly affected groups included patients (294 cases), children (278 cases) and customers (251 cases).
What are the most commonly stolen data types?
The types of data compromised in a breach often depend on their value to the attacker and the nature of the targeted organisation, whether for financial gain, fraud, extortion or identity theft.
The most commonly lost or stolen data types in 2025 paperwork-related breaches were:
- Basic personal identifiers (708 cases)
- Health data (418 cases)
- Financial data (117 cases)
The same top three data types apply to breaches involving employee information.
Over a third of all employee paperwork-related data breaches involved basic personal identifiers (112 cases), roughly 20% involved health data (65 cases) and 10% involved financial data (33 cases).
Incident response for offline data breaches
76% of businesses said that they internally report online cyber security breaches to directors or senior management.
This level of incident response isn’t reflected in non-cyber breaches. Of 1,820 cases, less than 1% of 2025 paper-related incidents resulted in a formal investigation.
Only one incident involving employee data was formally investigated in 2025.
How quickly are offline breaches reported to the ICO?
UK GDPR legislation states that organisations are required to report personal data breaches within 72 hours of becoming aware of them.
However, our 2025 analysis shows this deadline was missed in 41% of cases.
In 399 incidents, businesses took one week or more to notify the ICO, and in 351 cases, it took between 72 hours and one week.
For employee data breaches, 39% of incidents (130 cases) missed the 72-hour deadline.
The ICO chose not to use its formal powers in 1,429 paperwork mishandling cases last
year, giving guidance and advice instead.
In 2025, only 12 instances of paperwork-related breaches were referred to investigation teams to determine what action, if any, was suitable.
Given that paperwork-related data breaches have remained consistent since 2020, faster reporting and more substantial support are needed to reduce these figures.
What can you do to prevent offline breaches?
72% of businesses rank cyber security as a high priority for their company, but offline breach security is equally important in protecting data.
Preventative solutions for offline data breaches:
- Encrypt all data on laptops, phones, USB sticks and external hard drives
- Restrict access to spaces containing sensitive data with keycard access or install CCTV surveillance
- Secure placement of physical paperwork
- Shred sensitive documents before disposal
- Use an electronic document management system like DocuWare
Safely store your documents with Officeology’s DocuWare
DocuWare is a document management software that helps to protect your data from both cyber and offline data breaches.
Files are stored securely with centralised archiving, controlled access and data encryption.
DocuWare delivers ROI through improved efficiency. It stores, organises and manages your documents, while automating tasks like approvals, data entry and sending files.
Methodology
We analysed data from the Information Commissioner’s Office’s (ICO) data security incident trends report – specifically, looking at reported incidents involving paperwork (either ‘incorrect disposal of paperwork’ or ‘loss/theft of paperwork or data left in insecure location’). We investigated the number of paperwork data breaches in each year, sector and the type of data concerned with each breach.