Do you need help & advice with Cybersecurity?
If you run a UK business and you think you’ve been hacked, unplug the affected computers from the network, leave them switched on, and phone your cyber insurer and your IT support. Don’t use email to tell anyone, because the criminals may be reading it. If money has gone out, ring your bank straight away.
The first hour is when the expensive mistakes happen: switching off the wrong machine, wiping the evidence, or replying from an inbox the attacker is watching. Work through the steps in order. None of them needs any technical knowledge.
Unplug, don’t switch off. Phone your insurer, then your IT support. Ring your bank if money has moved. Report it to the police’s Report Fraud service on 0300 123 2040. Touch nothing else until the experts arrive.
Happening to you right now?
Don’t wait until you’ve worked out what it is. Call us on 020 8099 5540, or send us a message and we’ll ring you back.
Four mistakes that make an attack worse
Before you do anything else, avoid these:
What to do in the first hour, step by step
Get the affected computers off the network. Pull out the network cable and turn off the Wi-Fi on anything that looks wrong. That stops it spreading to other computers and, most importantly, to your backups. Only power a machine off if you can’t disconnect it any other way.
Phone your cyber insurer. If you have cyber insurance, this is the first call. Insurers have specialist teams who deal with attacks every day, and most policies expect you to involve them early. Bringing in your own outside experts without telling them first can put your claim at risk.
Phone your IT support. Not email. Tell them what you saw, when, and which computers you’ve disconnected.
If money has gone out, ring your bank now. Ask them to stop or recall the payment. If you don’t have their fraud number to hand, dial 159 from any phone: it puts you through to most UK banks, and criminals can’t fake it. Every hour counts.
Report it to the police. Report Fraud, which replaced Action Fraud in January 2026, asks any business under a live cyber attack to call 0300 123 2040 straight away. In Scotland, call Police Scotland on 101.
Leave the evidence alone. No wiping, reinstalling or tidying up. Take photos of the ransom note and warning messages, and keep the originals.
Change passwords from a computer you know is clean. Start with email and anything with admin rights, and switch on the code-on-your-phone check wherever it isn’t already on.
“We’ll just buy new computers”: why recovery takes weeks
The most common thing Dave hears from owners is that if the worst happened they’d buy new laptops and be back up in a day or two. It doesn’t work like that. The criminals have usually been inside for a while, they’ve often taken copies of your data, and every machine, account and backup has to be checked before anyone can trust it again.
From the attacks Dave has seen, plan on being disrupted for around two weeks. As a rough budget, allow about £3,000 per member of staff for the IT recovery alone, before legal advice, telling customers, or any ransom. The Marks & Spencer and Co-op attacks in spring 2025 showed that even household names with big IT teams can be knocked over for weeks.
It’s going to take two weeks minimum.
Dave Lane, GoodChoice IT
Owners who skip cyber insurance and the basic protections usually do it because nothing has gone wrong yet. Dave compares it to buying a car:
You go, well I don’t want airbags, seat belts. We don’t need any of those things. I’ve never had an accident.
Dave Lane, GoodChoice IT
Who else to tell in the UK
- The National Cyber Security Centre, the part of government that helps UK organisations deal with attacks. Its reporting form takes about 15 minutes. It isn’t a regulator and won’t pass your report on without asking you first.
- The Information Commissioner’s Office, the UK’s data protection regulator, if personal information about customers or staff may have been seen or stolen. You have 72 hours from finding out to report it when it puts people at risk, and you may also need to tell the people affected.
- Your customers and staff, with a short message as soon as you know something serious is going on.
Should you pay the ransom?
Ransomware is when criminals lock up your files and demand money to give them back. The police and the National Cyber Security Centre both advise against paying. Paying doesn’t guarantee you get your files back, it marks you as a business that pays, and if the gang is under UK sanctions, paying them breaks the law.
It’s your decision in the end, but make it with your insurer’s specialist team and the police, not on your own in the first hour. Sometimes a free tool to get files back already exists for the exact attack you’ve been hit by, which is one more reason to get the experts in before anyone talks about money.
What to tell your customers and staff
You can’t control the attack, but you can control what you say about it. As soon as you know something serious is going on, put out a short message such as “We’re investigating a problem with our systems and we’ll update you by 3pm.” It buys you time, and customers trust a business that’s honest about a problem far more than one that goes quiet.
Decide who sends that message, and how, before you need it. If your email and Teams are down, you’ll want staff mobile numbers and a WhatsApp group or a phone tree that doesn’t depend on your own systems.
Print one page today
Most of the panic in the first hour comes from not knowing who to call. If the numbers live on a server that’s just been locked, you can’t reach anyone. Dave gives his clients a single printed page, kept somewhere they can get to without a computer.
What to put on it
- Your cyber insurer: company name, policy number, claims phone number and email
- Your IT support: out-of-hours number and the mobile of a named person
- The directors and key managers: mobile numbers, not work extensions
- Your bank’s fraud line, with 159 as a backup, and Report Fraud on 0300 123 2040
- Where your backups are, and the date someone last tested getting files back from them
- Who sends the first message to customers and staff, and how
Where to keep it: print it, put a copy by your broadband box or server, and give one to every director to keep at home.
If you have a ransomware attack and you can’t get into your data, how are you going to contact these people?
Dave Lane, GoodChoice IT
When you’re ready to go further, our one-page incident response plan for UK small businesses turns that sheet into a full plan, and the National Cyber Security Centre’s response and recovery guide covers rehearsing it. If you haven’t got Cyber Essentials, the UK government-backed basic cyber security certificate, start there. It’s the minimum Dave recommends for any UK business, and many insurers and larger customers now ask for it.
For the work that makes an attack less likely in the first place, our free book Cybersecurity Essentials for Business Owners covers the attacks that hit small firms most and the security checklists insurers ask about.
Would your business cope?
If you’d like that page filled in properly, or a second opinion on how you’d cope with an attack, talk to Dave. Call us on 020 8099 5540, or send us a message and we’ll ring you back.
How do I know if my business has been hacked?
Some signs are obvious: a ransom note on screen, files that won’t open or have strange new names, or computers locking up one after another. Others are quieter. Customers or suppliers get odd emails from your address, staff receive password reset messages they didn’t ask for, money moves that nobody authorised, or emails go missing because someone has set up a hidden rule to forward or delete them. If you see any of these, treat it as an attack until your IT support tells you otherwise.
Our Microsoft 365 email has been hacked. What do we do?
Change the password from a clean device, sign the account out everywhere, and switch on the code-on-your-phone check. Then look for the trap most people miss: criminals often set up hidden inbox rules that forward copies of your email to them or hide replies from you, and they keep working after the password changes. Our guide to what to do when a Microsoft 365 account is hacked takes you through it, and how to spot hidden inbox rules shows where to look.
How long does it take to recover from a ransomware attack?
For a small business with an insurer’s specialist team behind it, Dave’s experience is around two weeks before things are close to normal, longer if the backups were hit too. Larger organisations can take far longer: the British Library was attacked in October 2023, and its main catalogue only came back, read-only, about 11 weeks later. Our guide to how ransomware attacks work explains why recovery is slow.
Does cyber insurance cover a ransomware attack?
Most UK cyber policies include a specialist team to manage the attack, the cost of getting your systems and data back, and some of the income you lose while you can’t trade. Whether a policy will pay towards a ransom varies, and some exclude it. The bigger risk is the proposal form: insurers ask whether you use the code-on-your-phone check, keep separate backups and install updates promptly, and as Dave puts it, if you lie to them the policy is going to be invalid. Our guide to what cyber insurers ask for lists the usual questions.
Will the bank refund money we sent to a scammer?
It depends on the size of the business. Since October 2024, banks have had to refund most victims of payments made by bank transfer after being tricked, up to £85,000, and the rules cover personal accounts and micro-enterprises: businesses with fewer than 10 staff and a turnover or balance sheet under €2 million. You have 13 months to claim. Larger businesses aren’t covered, so recovery depends on how fast the bank can freeze the money, which is why the first phone call matters so much.
Do we have to report every cyber attack to the ICO?
No. You must report a personal data breach within 72 hours only when it’s likely to put people at risk, for example of fraud, identity theft or distress. You do have to keep your own record of every breach, including the ones you decide not to report, with what happened and why you made that call. If you’re not sure, the Information Commissioner’s Office has a short self-assessment on its website that helps you decide.
Is it illegal to pay a ransom in the UK?
Not in itself, for a private business. It becomes a crime if the money goes to a person or group under UK financial sanctions, and many ransomware gangs are. The government has also announced plans to ban public sector bodies and operators of critical national infrastructure from paying, and to require other organisations to tell it before they pay. Your insurer’s team will check the sanctions position before any payment is even discussed.
What should a cyber incident response plan include?
Who is in charge during an attack, who to call (insurer, IT support, bank, police) with numbers that work when your systems don’t, how you’ll keep trading and what you’ll tell customers. It only needs to be a page or two, as long as everyone knows where it is and you’ve rehearsed it once. Our one-page incident response plan for UK small businesses is a template you can fill in.
