Russian cyberattacks against UK are 'Putin Tax' costing $3.3 billion, says lawmaker

The British government is failing to measure what Russian cyberattacks, sabotage and threats to critical infrastructure are costing the country, according to a lawmaker’s report published Wednesday. 

The report, which gives its own estimate of between £2 billion and £2.5 billion ($2.6 billion to $3.3 billion) a year — a figure described as a floor — is titled The Putin Tax and written by Labour MP Graeme Downie, alongside postdoctoral researcher Dominic Reed.

Its authors say their methodology in arriving at that figure was limited, but stressed the principal point was the lack of an official alternative.

Ahead of what is expected to be a difficult first budget from Prime Minister Andy Burnham’s new government later this month, the report argues that if the public cannot see what Russian activity costs, it cannot weigh that burden against the cost of defending against it.

Downie submitted a series of parliamentary questions to several government departments and found that ministers held no estimates of the economic impact of incidents linked to the Kremlin.

No analysis was done of the costs of two ransomware attacks — one on National Health Service software supplier Advanced, and another on Royal Mail — carried out by a group alleged to operate with the Kremlin’s tacit consent and, in some cases, with connections to Russian intelligence.

“The costs of flooding are measured or estimated because flood defenses cost money. The costs of fraud are measured because anti-fraud activity costs money. Hostile-state activity increasingly affects critical infrastructure, public services and the wider economy,” the report says. “Yet no equivalent effort has been made to understand its cumulative financial impact.”

The report also references the August 2025 cyberattack on Jaguar Land Rover, estimated to have cost the British economy $2.5 billion — although the U.K. government has not formally attributed it to Russia-linked actors — alongside an arson attack in 2024 ordered by Russia’s Wagner Group on a London warehouse.

The largest single component of the headline figure was derived by assuming Russia is responsible for 10% of the £14.7 billion ($19.3 billion) the government says cybercrime costs British businesses annually, although this percentage was not based on a precise attribution.

The remaining figures, including hostile activity threatening subsea cables, are also from models and not public data. 

A matter of trust

The report’s argument echoes one made by Gen. Sir Jim Hockenhull, the former head of Britain’s Defence Intelligence, in an interview with Recorded Future News earlier this year. Hockenhull said Britain has failed to make the public case for investing in security, in part because the evidence underpinning that case stays classified.

“We assume the public understands the connection, but if our insight stays highly classified, in the hands of senior officials and politicians, we’re effectively asking people to trust us without seeing the evidence,” he said.

He called for a sustained coalition effort — inside and outside government — to make the threat accessible and understood, warning that repeating “war is possible” without context is an argument that cannot compete with funding for schools or healthcare.

One of Downie’s recommendations — a national public awareness campaign on hostile-state threats and cyber resilience — is a direct response to that gap.

The report also recommends that the government publish annual economic assessments of hostile foreign-state activity, that the National Cyber Security Centre include cost estimates alongside attribution in its reporting, and that the Ministry of Defence develop a methodology for costing physical hostile activity.

“The challenge now is not proving that the Putin Tax exists but ensuring that Britain starts measuring it,” said Downie.

The Cabinet Office did not immediately respond to a request for comment.