Employees lose access to essential systems, customer data faces exposure, payments are disrupted, and attackers could retain access to your network. For small businesses without a dedicated IT security team, knowing what to do after a cyber attack in the UK is essential to limiting damage, protecting sensitive information, and getting operations back on track.
The first steps matter: contain the attack, secure compromised accounts, preserve evidence, and identify which systems or data have been affected. You also need to assess whether the incident triggers legal or contractual reporting duties, including notification to the Information Commissioner’s Office (ICO) where applicable. Restoring systems too early leaves the threat unresolved and exposes your business to another attack.
Cyber Attack Response Checklist: Your First 24 Hours
Use this cyber attack response checklist to organise your response. The timings are practical priorities, not rigid deadlines; a live ransomware attack, suspected data theft or compromised business email account requires immediate action.
First-day action list
0 of 6
Immediately
Confirm the incident and alert the right people.
Notify the business owner or incident lead, contact your IT provider and use a separate, trusted device for communications if your network may be compromised.
First 15–60 minutes
Contain the attack
Isolate affected devices from the network, secure compromised accounts and contact your incident response specialist. Avoid actions that could destroy evidence.
First 1–3 hours
Preserve evidence and assess the impact.
Record times, suspicious messages, affected systems, account activity and ransom demands. Establish which data and services are affected.
First 3–6 hours
Start reporting and notification decisions.
Assess whether the incident needs reporting to the ICO, NCSC, police, your insurer, customers or a sector regulator.
First 6–12 hours
Plan safe recovery
Verify backup availability, identify a clean recovery environment and prioritise essential business services.
First 12–24 hours
Coordinate communications and next steps
Keep staff and relevant stakeholders informed, document decisions and agree on a recovery plan based on verified facts.
1. Recognise the Signs of a Cyber Attack
The first step is to establish whether your business is dealing with a genuine cyber incident. You do not need to know exactly how the attack happened before starting your response.
Common warning signs include unexpected password resets, unfamiliar administrator accounts, employees locked out of email, unusual payment requests, files that have suddenly become encrypted, suspicious software running on company devices or customers receiving messages you never sent.
A cyber attack does not always produce an obvious ransom note. An attacker who gains access to a business email account might quietly monitor conversations, steal invoices or change bank details before anyone notices.
2. Contain the Attack Without Destroying Evidence
Stopping further damage is an immediate priority. The right containment action depends on the type of attack and which systems are affected.
If a laptop is displaying a ransomware message or sending suspicious traffic, disconnect it from Wi-Fi and wired networks. Do not reconnect it just to check whether it is working. Contact your IT support provider or an incident response specialist for instructions.
If an email or cloud account has been compromised, use a separate, trusted device to secure the account. Revoke active sessions, change the password and review multi-factor authentication settings. If attackers have access to administrator accounts, involve your IT security team before making changes that could affect other systems.
For a small business, containment may also mean temporarily disabling remote access, restricting access to shared files or suspending affected services. These decisions need to balance the risk of further compromise against the disruption caused by taking systems offline..
3. Preserve Evidence and Establish What Happened
Once the immediate threat is being contained, build a reliable record of the incident. You do not need a complete technical investigation within the first few hours, but you do need enough information to guide decisions and assess reporting obligations.
Record the discovery time, affected accounts and devices, suspicious login activity, messages received, files accessed or encrypted, unusual transactions and any ransom demand. Keep copies of relevant emails, screenshots and alerts where it is safe to do so. Ask your IT provider to preserve relevant security logs and investigate possible unauthorised access.
Avoid sending sensitive evidence through a compromised email account or storing it on an affected network. Keep an incident log in a separate, secure location and record every significant action, including who approved it and when it took place.
What Information Should You Record?
| Information | Why it matters |
| Date and time discovered | Establishes the response timeline and helps assess reporting deadlines |
| Affected systems and accounts | Helps determine the scope of the compromise |
| Type of attack suspected | Guides containment and investigation |
| Personal or business data affected | Supports risk assessment and notification decisions |
| Financial losses or service disruption | Helps prioritise recovery and insurance claims |
| Actions taken and decisions made | Provides an auditable record of the response |
| External parties contacted | Tracks regulatory, contractual and operational notifications |
4. Assess Whether Personal Data Has Been Compromised
A cyber attack becomes a personal data breach when personal information is lost, destroyed, altered, disclosed without authorisation or accessed without permission. This includes more than stolen customer databases.
Examples include an attacker accessing employee payroll records, downloading customer contact details, reading email containing personal information or encrypting records so the business can no longer access them.
Determine which categories of personal data might be affected, how many people could be involved and what the consequences might be. Consider financial information, identity documents, employee records, customer contact details and confidential information about vulnerable individuals.
5. Decide Who to Report the Cyberattack to in the UK
There is no single report that automatically fulfils every cyber incident reporting obligation. Knowing who to report a cyberattack to UK authorities depends on whether the incident involves a personal data breach, suspected criminal activity, a significant technical incident or a sector-specific reporting requirement.
Information Commissioner’s Office (ICO)
Report a personal data breach when the legal reporting threshold is met. Under the UK GDPR, a controller must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a breach unless it is unlikely to pose a risk to people’s rights and freedoms.
National Cyber Security Centre (NCSC)
Report the cyber incident through the NCSC’s reporting service, especially when the attack affects business systems, customer or employee data, or could benefit from specialist guidance. Reporting to the NCSC does not replace regulatory or law-enforcement reports.
Report Fraud or Police Scotland
Report suspected cybercrime, fraud, financial loss or criminal activity through the appropriate national reporting route. Businesses in Scotland should use Police Scotland’s reporting arrangements. For an immediate threat to life or safety, call 999.
Your cyber insurer and relevant regulators
Notify your insurer promptly in line with your policy. If your business operates in a regulated sector or holds contracts with specific security clauses, check whether separate notifications are required.
6. Do You Have to Report a Cyber Attack to the ICO Within 72 Hours?
Not every cyber attack must be reported to the ICO. The 72-hour requirement applies to personal data breaches that are likely to pose a risk to individuals’ rights and freedoms. The period runs from when the organisation becomes aware of the breach, not necessarily from the time the attacker first gained access.
If the breach meets the reporting threshold, notify the ICO as soon as possible. Do not delay notification while waiting for a complete forensic investigation. You can provide the information available initially and follow up with additional details.
If your assessment concludes that the breach is unlikely to create the relevant risk, you might not need to notify the ICO. However, you must document the breach and be able to justify your decision.
The ICO’s guidance reflects changes introduced by the Data (Use and Access) Act 2025, so check its current reporting instructions when an incident occurs.
7. Contact Your IT Provider and Begin Safe Recovery Planning
Once you have contained the immediate threat, work with your IT provider or a qualified cyber incident response specialist to establish how the attacker entered your systems and whether unauthorised access remains.
The investigation should examine compromised accounts, vulnerable software, remote access, suspicious administrator activity and any evidence of data theft. If your business lacks in-house expertise, the NCSC’s assured cyber incident response providers offer a route to specialist support.
8. How Should a Small Business Restore Its Systems?
Recovery starts with identifying which systems are safe to restore and which need further investigation. Reconnecting infected devices or restoring compromised accounts too early can give attackers another opportunity to disrupt the business.
Prioritise essential services such as customer communications, order processing, payroll and financial systems. Before restoring them, confirm that the underlying vulnerability has been addressed, compromised credentials have been secured and the recovery environment is clean.
Check backup availability and integrity before using backups to restore data. A backup that contains malware or was accessible to the attacker might not provide a safe recovery point. Maintain a separate record of which backups have been checked and which systems are ready to return to service.
9. Communicate With Staff, Customers and Suppliers
Poor communication creates additional problems during a cyber attack. Employees might continue using compromised accounts, customers might act on fraudulent messages, and suppliers might send payments to accounts controlled by attackers.
Assign one person to coordinate external communications and agree on what the business can confirm. Staff need practical instructions about which systems to avoid, how to communicate securely and where to report suspicious activity. If business email is compromised, use a verified alternative channel.
Contact customers or suppliers when the incident affects them or creates a relevant risk. If an attacker has sent fraudulent payment instructions from your email account, warn affected recipients through a previously verified telephone number or another secure channel.
10. Avoid These Common Mistakes After a Cyber Attack
The pressure to get a business running again can lead to decisions that increase the damage or make the investigation more difficult.
- Deleting evidence: Wiping devices, deleting suspicious messages or clearing logs before investigators review them can remove useful evidence.
- Restoring systems too early: Reconnecting affected devices before securing the environment can allow the attacker to regain access.
- Changing passwords on compromised devices: Entering new credentials into a device controlled by an attacker can expose those credentials as well.
- Ignoring reporting obligations: Failing to assess ICO, contractual or sector-specific requirements can create additional legal and operational problems.
- Paying a ransom without specialist advice: Payment does not guarantee data recovery, deletion of stolen information or an end to the attack.
- Assuming backups are safe: Backups must be checked for integrity and suitability before restoration.
- Keeping everyone uninformed: Staff and affected customers need accurate, proportionate instructions to reduce further harm.
11. What to Do After the First 24 Hours
The response continues after the immediate crisis. Once the attack is contained and recovery is underway, investigate the root cause, confirm the extent of any data exposure and document the lessons learned.
Review access permissions, multi-factor authentication, patch management, endpoint protection, backup arrangements and security monitoring. Where the incident involved a compromised supplier or third-party service, reassess the security arrangements governing that relationship.
Your business should also review its incident response plan. Record what worked, where decisions were delayed, whether staff knew whom to contact and whether reporting responsibilities were clear. Use these findings to improve procedures and assign owners to outstanding actions.
Cyber Essentials provides a practical framework for reviewing baseline technical controls, while ISO 27001 offers a broader approach to managing information security risks. Neither certification replaces an effective incident response plan, but both can support improvements to your wider security arrangements.
Respond Quickly to a Cyber Attack and Protect Your UK Business
The first 24 hours after a cyber attack demand quick action, but every decision needs a clear purpose. Contain affected systems, secure compromised accounts, preserve evidence and establish what information or services have been affected. At the same time, assess reporting obligations rather than assuming that one notification covers every legal or contractual requirement.
For UK small businesses, the most important deadlines can begin before the technical investigation is complete. Contact the relevant cybersecurity specialists, keep affected people informed when necessary, and restore systems only when they are safe to use.
A documented response, verified backups and clear reporting responsibilities help your business recover more effectively. Cubersecurity Services UK can help you assess security gaps and strengthen your defences so your organisation is better prepared for another incident.
FAQs
1. We Have Been Hacked: What Should We Do First?
If we have been hacked, what to do? Start by containing the attack and contacting your IT provider or an incident response specialist. Isolate affected devices where appropriate, use a separate trusted device for communications, secure compromised accounts and preserve evidence. Assess whether personal or business data has been exposed before restoring systems.
2. Who Do I Report a Cyberattack to in the UK?
Depending on the incident, report it to the NCSC, Report Fraud, Police Scotland, the ICO where a reportable personal data breach has occurred), and any relevant sector regulator. Notify your cyber insurer in accordance with your policy. Reporting to one organisation does not automatically satisfy every other reporting obligation.
3. What Are the First Steps After a Data Breach?
The first steps after a data breach are to contain the incident, secure affected accounts, preserve evidence and determine what personal information was accessed, lost, altered or disclosed. Assess the potential risk to individuals, document your findings and notify the ICO within the applicable timeframe if the breach meets the reporting threshold.
4. Should I turn off my computer after a cyber attack?
If a device appears compromised, disconnect it from the network where safe and appropriate, then contact your IT security specialist. Do not automatically shut down or wipe every affected device, as this can remove evidence or complicate investigation. Follow specialist instructions based on the type of attack and the affected system.
5. How can a small business recover from a ransomware attack?
Isolate affected systems, preserve evidence and engage qualified incident response support. Investigate how the ransomware entered the environment, secure compromised credentials, verify that backups are clean and restore systems in a controlled order.