Two official reports published this year give the clearest picture yet of the cyber risks facing Isle of Man organisations. In May 2026 the Cyber Security Centre for the Isle of Man (CSC) released its Annual Cyber Threat Update 2025–2026, covering April 2025 to March 2026. In July 2026 the Isle of Man Information Commissioner published her annual report, which iomtoday and Manx Radio reported as showing a sharp rise in personal data breaches.
Neither report suggests island businesses face exotic threats. The attacks causing the most harm are familiar ones: fake invoices, hijacked email accounts and scam phone calls. This guide sets out what the figures show, what they mean for a business in Douglas, Ramsey or anywhere on the island, and the practical steps that address each risk.
The headline figures
| Measure | Figure | Source |
|---|---|---|
| Suspicious emails reported to the CSC's Suspicious Email Reporting Service (SERS) | 6,423 | CSC, April 2025 to March 2026 |
| Cyber concerns reported to the CSC | 390 | CSC |
| Financial losses reported through those cyber concerns | £1,048,492 | CSC |
| Personal data breaches reported to the Information Commissioner | 200 (up from 152) | Information Commissioner, 2025/26 |
| People estimated to be affected by those breaches | About 31,600 (up from 4,918) | Information Commissioner, 2025/26 |
| Data protection complaints | 53 (up from 25) | Information Commissioner, 2025/26 |
Two cautions apply. The CSC stresses that its loss figures come only from reports it received, and expects the real total to be notably higher because so much cyber crime goes unreported. And the Information Commissioner attributes the jump in people affected to a rise in cyber incidents, which can affect large numbers of people in a single breach. One compromised system can now mean thousands of notification letters.
Invoice fraud is the costliest threat
According to the CSC, invoice scams were the single largest source of reported losses, at £265,875. Invoice fraud works by getting a business to pay a genuine-looking invoice into the wrong bank account. Criminals impersonate a supplier, intercept a real invoice and alter its payment details, or send a convincing request to "update our bank details".
The CSC's report describes one local organisation that lost roughly £142,000 this way. The attacker used a lookalike email domain to impersonate a business in the conversation, intercepted a genuine invoice and forwarded falsified payment instructions, leading to two transfers into a fraudulent account. It came to light only when the real supplier asked about the missing funds. Crucially, the investigation found no email compromise: nobody's mailbox was hacked. The attacker relied entirely on a convincing lookalike address and a busy accounts process.
How to stop invoice fraud
- Call back before changing bank details. Verify any new or changed payment details by phone, using a number already on file, never one given in the email. The CSC's guidance throughout the year emphasised independent verification of payment changes and supplier details.
- Use two people for new payees. One person sets up or changes a payee and another approves it, especially for large or first-time payments.
- Look at the sender's domain, not just the name. Lookalike domains swap or add a single character. Configure your email system to flag messages from outside the organisation.
- Protect your own domain. Publish SPF, DKIM and DMARC records so criminals find it harder to send email that appears to come from you. Our free DNS lookup tool shows what your domain currently publishes.
- Brief finance staff and suppliers. Agree with key suppliers that you will never change bank details by email alone, and ask them to do the same for you.
Email account compromise: 88 confirmed cases
The CSC recorded 88 confirmed account compromises and nearly 300 suspected compromises reported through SERS. Most began with emails mimicking routine security or service notifications. The CSC notes that attackers were especially successful during periods of organisational or platform change, using verification, migration or update themes to exploit uncertainty. In the Isle of Man, account compromises have typically involved imitating local businesses to harvest passwords. Of the suspicious emails reported overall, the majority imitated legitimate email providers, and many targeted manx.net users.
Once inside a mailbox, the CSC says, attackers kept control by adding mailbox rules, changing recovery details, or abusing sign-in tokens and malicious apps. A password reset alone may not remove them.
Hardening Microsoft 365 and other business email
- Require multi-factor authentication for every account, preferably with an authenticator app rather than text messages, and block older sign-in methods that bypass it.
- Alert on new inbox rules and external forwarding. These are classic signs of a compromised mailbox and should trigger an investigation.
- Restrict which third-party apps users can grant access to. Malicious apps can keep access even after a password change.
- Review recovery details and sign-in history for anyone who reports a suspicious email or unusual behaviour.
- Use Conditional Access if you have Microsoft 365 Business Premium, so sign-ins from unmanaged devices or unexpected countries can be blocked or challenged.
- Warn staff before any change. If you are moving to a new email platform or changing passwords policy, tell people in advance that genuine messages will never ask them to enter their password through a link. Our Microsoft 365 migration guide covers securing sign-in from day one.
If you suspect a compromise, revoke the user's sessions, reset the password, remove unfamiliar inbox rules and app permissions, check recovery details, and look at what the account sent while it was compromised.
Scam phone calls and impersonation
Vishing (voice phishing) caused £259,604 of reported losses, the second-biggest financial impact in the CSC's figures. Callers impersonate banks, suppliers or officials, often using public information such as names and addresses, and spoofed numbers that appear genuine. The CSC's report describes a victim who took calls from someone posing as their bank's fraud team, then opened their banking app to find card payments of over £50,000 had already been processed. The CSC also reports that gift card fraud, where criminals impersonate colleagues or managers and ask for urgent gift card purchases, remained extremely prevalent.
For businesses, the defences are procedural:
- End unexpected calls about payments or security and call back on a number you already hold.
- Never read out one-time codes, passwords or card details to an inbound caller.
- Treat urgent requests for gift cards or out-of-process payments as suspicious, however senior the person appears to be.
- Agree how your IT provider will contact staff, so a fake "IT support" call stands out.
Ransomware remains the most disruptive risk
The CSC describes ransomware as continuing to pose the most immediate and disruptive cyber risk to organisations, with attackers focused on data theft, extortion and disruption. It also notes that while the Isle of Man is unlikely to be a direct target of state-backed actors, its close integration with the UK, EU and global systems leaves it exposed to secondary impacts such as supply-chain compromise and opportunistic ransomware.
Its conclusion is practical: for Isle of Man organisations, the decisive factor is preparedness, not the threat level. The measures it highlights are offline backups, patching, access control and rehearsed incident response. Our ransomware response plan for Isle of Man businesses covers what to do if the worst happens, and SIEM and MDR explains how continuous monitoring helps spot attacks early.
Data breaches: what the Information Commissioner's figures mean
The 200 personal data breaches reported in 2025/26 are only those notified to the Commissioner, and the year also brought five regulatory actions, including reprimands for organisations across the public and private sectors. The Commissioner's office introduced a new online breach reporting and registration system during the year, and complaints more than doubled, with the handling of subject access requests the most common issue.
A separate case shows how breaches happen without any hacking. In August 2026 the Commissioner reprimanded the Cabinet Office after electoral registration letters sent to "The Occupier" included personal details of previous residents, affecting an estimated 3,215 people. The Commissioner noted that the risk had been recognised at the risk assessment stage, and that organisations should mitigate such risks even if it means changing their preferred approach. She also noted that the breach was reported promptly, which was taken into account. The lesson for any business is the same: build data protection in from the start, and report quickly if something goes wrong.
Reporting a breach on the Isle of Man
- Assess the breach. Not every incident needs reporting. The Commissioner publishes guidance on assessing the risk to individuals.
- Report within 72 hours where required. The Commissioner should be notified within 72 hours of becoming aware of a notifiable breach, using the online form. If more than 72 hours have passed, you must explain the delay.
- Report what you know. If you do not have the full picture, say so and give an estimated timescale for the remaining information. Updates can be sent to breach@inforights.im.
- Report the crime and the threat. Report cyber crime to the Isle of Man Constabulary and the CSC, and forward suspicious emails to the CSC's SERS, which also passes them to the UK's National Cyber Security Centre.
- Check your other obligations. Regulated firms should consider their duties to the Isle of Man Financial Services Authority, and gambling licence holders their duties to the Gambling Supervision Commission.
Cyber Essentials: an island-backed baseline
The most direct way to address these risks is to put the basic controls in place and have them checked. The CSC recommends Cyber Essentials, the UK government-backed scheme that assesses five controls: firewalls, secure configuration, user access control, malware protection and security update management. According to the CSC, the Isle of Man Government offers a 50% discount for eligible businesses, and funding may be available through the Department for Enterprise's Business Improvement Scheme. Cyber Essentials Plus adds a hands-on technical verification, and both certifications last 12 months.
Omega IT holds Cyber Essentials Plus certification (2026, via CyberSmart), so we work to the same standard we help clients achieve.
A 30-day cyber checklist for Isle of Man businesses
This week
- Introduce a call-back rule for any change of supplier bank details, and tell your accounts team and key suppliers.
- Check that every email account uses multi-factor authentication, including shared mailboxes and directors' accounts.
- Look for unexpected inbox rules and forwarding in Microsoft 365 or your email system.
- Confirm you have at least one backup that ransomware cannot reach, and when it was last restored successfully.
This month
- Publish or tighten SPF, DKIM and DMARC for your domains.
- Restrict third-party app consent and turn on alerts for risky sign-ins.
- Patch or retire anything out of support, including old servers and routers.
- Write down who to call in an incident, including the Information Commissioner's 72-hour reporting route, and keep it somewhere offline.
- Run a short session for staff on invoice fraud, vishing and fake security notifications, using the examples in the CSC report.
- Start Cyber Essentials, and ask whether your business qualifies for the 50% discount.
Common questions
Are Isle of Man businesses specifically targeted?
Mostly not by name. The CSC says its statistics show criminals target individuals and organisations of all sizes in every sector, and that account compromises on the island have typically involved imitating local businesses. The island's links with the UK and EU also expose it to supply-chain attacks aimed elsewhere.
Who should we report a cyber incident to on the Isle of Man?
Report crime to the Isle of Man Constabulary and contact the Cyber Security Centre for the Isle of Man. If personal data is involved, assess whether the breach must be reported to the Information Commissioner, normally within 72 hours. Regulated firms should also consider their regulator.
Do we have to report every data breach?
No. A breach must be reported if it is likely to result in a risk to people's rights and freedoms. Use the Commissioner's guidance to assess the risk, and record your decision either way.
How can we spot a lookalike domain?
Compare the full address character by character with one you know is genuine, especially in emails about payments. External-sender banners help, and your IT provider can monitor for newly registered domains that resemble yours.
Is Cyber Essentials cheaper for Isle of Man businesses?
According to the CSC, the Isle of Man Government offers a 50% discount for eligible businesses, and funding may also be available through the Department for Enterprise's Business Improvement Scheme. Check eligibility before you apply.
How Omega IT can help
Omega IT is based in Douglas and helps businesses across the island secure email, devices and data, prepare for Cyber Essentials and respond when something goes wrong. See our cyber security services and Microsoft 365 services, book a free IT Discovery Session or contact us.
Sources
- Cyber Security Centre for the Isle of Man: Annual Cyber Threat Update 2025–2026 (published 5 May 2026; full report, PDF)
- iomtoday: Sharp rise in personal data breaches on the Isle of Man (13 July 2026)
- Manx Radio: Sharp rise in data breaches on Island, says Information Commissioner's Office (July 2026)
- iomtoday: Isle of Man Government reprimanded over voters' data breach (10 August 2026)
- Isle of Man Information Commissioner: Report a personal data breach and additional guidance
- Cyber Security Centre for the Isle of Man: Cyber Essentials
Related reading
- Cyber security for Isle of Man businesses: where to start
- Ransomware response plan for Isle of Man businesses
- Isle of Man copper switch-off: a business guide
Image credits: featured image of the Sefton building, Douglas, by T on Unsplash; laptop photo by Luca Bravo on Unsplash, both used under the Unsplash License. Chart and diagram by Omega IT.