On 7 October 2026, Labour MP for Dunfermline and Dollar Graeme Downie, who serves as deputy chair of the All-Party Parliamentary Group on Rearmament, together with researcher Dominic Reed, published an analytical report titled Putin’s Tax. The foreword was written by Tom Keatinge, Director of the Centre for Finance and Security at the Royal United Services Institute (RUSI). The report represents the first comprehensive attempt to assess the cost of the Kremlin’s hybrid aggression to the British economy and society since 2022, and it has already produced a significant shift in British political and economic debate. According to the authors, the bottom line is substantial: the UK’s minimum annual costs stand at £2–2.5 billion. They immediately stressed that this figure is not an official government calculation but merely a lower bound — far from the ceiling of actual losses.
To grasp the true scale of these losses, they must be translated into social priorities that every citizen can understand. £2 billion, for example, equals the annual starting salaries of roughly 62,000 nurses or police officers, while the upper figure of £2.5 billion would cover the recruitment of nearly 78,000 police officers and healthcare workers, or 73,000 schoolteachers. The conclusion is sobering: under conditions of tight fiscal restraint, British taxpayers are forced to pay for the consequences of systematic Russian sabotage, cyberattacks and disruption of critical infrastructure instead of investing in healthcare, education and public order.
The structure of this “Putin tax” consists of several blocks, with the heaviest impact falling on British industry. Large confirmed incidents alone cost an average of £400–500 million per year, while cumulative damage runs into the billions. A striking example was the cyberattack that paralysed Jaguar Land Rover at the end of August 2025. Production was halted for about five weeks, threatening the stability of a supply chain supporting around 120,000 jobs. Experts at the Cyber Monitoring Centre estimated the total damage to the British economy at approximately £1.9 billion, while the report places the range at £1.6–2.1 billion. In June 2026, The New York Times reported that investigators from the FBI, the UK’s National Crime Agency and the National Cyber Security Centre linked the attack to a group based in Russia. The crisis also had a direct macroeconomic effect: UK GDP growth in the third quarter of 2025 was a negligible 0.1%, which analysts attributed largely to the shutdown of the car giant.
There have been other, smaller but no less telling episodes. In January 2023, the LockBit group — officially classified by US, UK and other law-enforcement agencies as a Russian-based hacking group — attacked Royal Mail. The incident cost the parent company around £10 million to remediate and strengthen its digital systems. A similar strike hit Advanced, a software supplier to the National Health Service, triggering widespread disruption across healthcare facilities. The analytics firm CyberCube has recorded more than 300 Russia-linked cyber incidents against British companies since 2022, while describing this figure as a significant undercount due to weak attribution. Multiplying 300 cases by the government’s benchmark of £195,000 per significant incident yields only £58.5 million — less than one-thirtieth of the damage from the Jaguar Land Rover attack alone.
The bulk of cyber losses, however, remains hidden. A November 2025 study by the Department for Science, Innovation and Technology estimated the annual cost of cyberattacks to British business at £14.7 billion, or 0.5% of GDP. Taking a conservative 10% of this sum as Russia’s potential share, the authors of the report arrived at £1.47 billion per year; raising the Russian share to 20% pushes the figure to £2.94 billion.
At the same time, the Kremlin’s hybrid war has moved beyond the digital domain. In March 2024, counter-terrorism police linked the arson of a commercial warehouse in Leyton, east London, to a direct order from the Russian private military company Wagner; direct damage was about £1 million, excluding investigation costs and business interruption. In November 2024, the appearance of unidentified drones over RAF Lakenheath required more than £600,000 in police investigative activity alone, while the indirect costs from disruption to nearby airports are virtually impossible to quantify.
A separate risk factor is undersea critical infrastructure. Estimates of potential damage and the costs of protecting subsea communications cables range from £250–500 million per year. The final assessment does not include the costs of enhanced physical protection, inflated insurance premiums, revised investment decisions or cascading effects through supply chains. CyberCube specialists note a 5% probability of a single targeted Russian attack capable of inflicting £3.3 billion in damage on one British company.
The root of the problem remains London’s own stance. Parliamentary questions by Graeme Downie have revealed a systemic reluctance among government departments to calculate the total financial damage. In an official response of 9 September 2026 to a question about Russian cyberattacks, the executive provided incident statistics but offered no financial assessment whatsoever. Moreover, British agencies frequently lump all “hostile states” into a single category, avoiding precise attribution — a sharp contrast to the regular government publications of damage estimates from flooding or fraud. In a comment on 7 October 2026, RUSI described Downie and Reed’s effort as useful but pointed to the difficulties of separating criminal activity from state operations and of distinguishing incurred losses from future risks.
The British experience mirrors processes unfolding across the European continent. In the Baltic region, damage to undersea cables has become a regular threat. In December 2024, the tanker Eagle S, part of the so-called Russian-oriented “shadow fleet”, was linked to the severing of the Estlink 2 cable between Finland and Estonia; repairs lasted months and cost tens of millions of euros. A similar incident affected the C-Lion1 cable. In Poland, Germany and the Baltic states, warehouse arsons, attempted sabotage of railways and defence-industry facilities, and unidentified drones periodically disrupting major European airports have all been recorded.
In September 2026, Politico Europe concluded that European business is already fully paying for Russia’s hybrid war out of its own pocket through downtime, repairs and soaring insurance costs. Yet not a single capital on the continental mainland has so far taken the step of consolidating these scattered costs into a single national account. Political fear of official attribution and unwillingness to acknowledge that Europe is already deep inside a “grey zone” create dangerous social risks. Against a backdrop of budget deficits and growing public fatigue with geopolitical tension, it is becoming increasingly difficult for European governments to explain the need for higher defence spending. Without an understanding that hybrid warfare is already extracting money from citizens’ pockets through higher prices for goods, services and insurance, public support for security measures is eroding rapidly.
The authors of Putin’s Tax propose moving away from a strategy of silence without requesting new funding. Their plan consists of four steps: an annual government report to Parliament on the cost of actions by hostile states with the highest possible degree of attribution; publications by the National Cyber Security Centre assessing major attacks; the adoption of Ministry of Defence methodology for calculating physical damage; and the launch of a nationwide resilience programme.
Putin’s Tax is the bill for hybrid aggression that British and European companies, taxpayers and public services are already paying every day. The United Kingdom has taken the first — albeit incomplete — but principled step toward calling things by their proper names and measuring the price of enemy aggression. Continental Europe still prefers to close its eyes to mounting losses, hoping that hybrid storms will simply blow over. In modern geopolitics, however, one rule is immutable: what is not measured cannot be prevented or deterred. And as long as European capitals refuse to count their financial losses, the price of their silence becomes more unbearable for ordinary citizens with every passing day.
