What to do in the first hour of a cyber attack
If your business is hit by a cyber attack, the first hour matters. It is also the easiest time to make things worse by turning off the wrong machine, deleting evidence, or emailing from an account the attacker may already be reading.
Before anything else: do not make it worse
When something frightening appears on screen, the natural instinct is to start fixing it.
That is understandable. It is also where many businesses accidentally make the incident harder to investigate and recover from.
- Do not turn the affected device off if you can avoid it.
Disconnect it from the network instead. Unplug the network cable and turn off Wi-Fi. Turning a device off can remove evidence held in memory that may help your IT provider or incident response team understand what happened. - Do not start deleting things.
Keep ransom notes, suspicious emails, alerts, browser tabs and error messages. They may help your IT provider work out what happened. - Do not wipe or reinstall affected devices.
That may remove evidence needed to understand the attack and prevent it happening again. Recovery should be planned, not improvised. - Do not keep using a suspected compromised account.
If an attacker is in your email, they may be able to read messages about the incident. Use the phone or a separate trusted account. - Do not let anyone make major changes before checking cyber insurance.
Some cyber insurance policies require you to notify the insurer early and use their approved incident response team before systems are restored, wiped or rebuilt. - Do not rush into paying a ransom.
Payment does not guarantee recovery, and you should speak to your IT provider, insurer and law enforcement before making that decision.
Think of it like a burglary. You would not tidy the room before the police had seen it. A cyber incident is similar. Make it safe, preserve what happened, and get the right people involved before changing things.
Video: what to do in the first hour
Add a short explainer video here for staff, directors or business owners. Keep it calm and practical. The aim is to help people remember the order of actions before they are under pressure.
The step-by-step cyber attack response
Work through these steps in order. You do not need to be technical. You need to stay calm and avoid making the attacker’s job easier.
- Disconnect affected devices from the network.
Unplug the network cable and turn off Wi-Fi on anything that looks affected. Do not power the device off unless you cannot isolate it any other way or your IT provider tells you to. This helps stop the problem spreading while preserving evidence. - Call your IT provider by phone.
Do not email from the affected account. The attacker may already be watching the mailbox. - Call your cyber insurance provider early.
If you have cyber insurance, call the insurer’s incident line before major changes are made or recovery work starts. Some policies require their approved incident response team to be involved before IT support wipes systems, restores backups or rebuilds devices. - Preserve evidence.
Do not wipe, reinstall, delete or tidy up affected systems. Take photos or screenshots of messages and alerts, but keep the originals in place. - If money was sent, call your bank immediately.
Ask whether the payment can be stopped, recalled or frozen. With payment fraud, speed matters. - Change passwords from a clean device.
Start with email, Microsoft 365, banking, password manager and admin accounts. Turn on multi-factor authentication if it is not already enabled. - Report it through the correct UK route.
Reporting can help you get the right support and may be required depending on the incident.
Where should a UK business report a cyber attack?
The right reporting route depends on what happened and where your business is based.
NCSC
You can report a cyber incident to the National Cyber Security Centre. The NCSC incident reporting form says not to complete the form from a network you believe has been compromised.
Report Fraud / Action Fraud
If you are in England, Wales or Northern Ireland and have been affected by fraud or cyber crime, Report Fraud is the main reporting route.
Police Scotland
If your business is in Scotland, the National Crime Agency points victims of fraud to Police Scotland on 101.
ICO
If personal data about customers, staff, pupils, residents, patients or suppliers may have been exposed, you may need to assess whether the incident is reportable to the Information Commissioner’s Office.
Do not report from a device or network you think is compromised. Use a separate trusted device and connection where possible.
What if personal data was exposed?
A cyber attack is not always a personal data breach. But it can be.
If an attacker accessed, stole, encrypted, changed, deleted or disclosed personal data, you need to assess the risk to the people affected.
For a small UK business, that could include names, addresses, payroll information, HR records, customer lists, invoices, care records, school records, financial information or copies of ID documents.
The ICO has guidance for small organisations on what to do in the first 72 hours after discovering a personal data breach.
Do this early. Speak to your IT provider, insurer or legal adviser so you do not miss a reporting deadline or say the wrong thing to affected people.
Should you pay a ransom?
If it is ransomware, this may be the question everyone asks first.
The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands.
Paying does not guarantee you will get your files back. It may mark you as an organisation that pays. It also funds further criminal activity.
That does not mean the decision is simple when your business is under pressure. It does mean you should not make it alone in the first panicked hour.
- Speak to your IT or incident response team.
They may know whether recovery is possible from backups or whether a known decryption option exists. - Check your cyber insurance policy.
Your insurer may require you to notify them early and use an approved incident response provider before systems are restored, rebuilt or changed. - Check legal and sanctions risk.
Paying a criminal group can create serious legal and regulatory issues, especially if the recipient is sanctioned.
Source: NCSC ransomware guidance.
The best time to prepare is before it happens
You do not need a 90-page incident response document that nobody reads.
For most small UK businesses, a one-page plan is a good start.
- Who to call first.
Include your IT provider, cyber insurer, bank, key internal decision makers and any legal or data protection contact. - Where those numbers are kept.
Store them somewhere you can access without your main email, server or phone system. - Where your backups are.
Include who manages them, what they cover, and when they were last tested by restoring data. - Which systems matter most.
List the systems you need to trade, pay staff, invoice customers, access email and serve clients. - Who is allowed to make decisions.
In a crisis, confusion costs time. Decide who can authorise shutdowns, communication, recovery work and insurer contact.
Print it. A cyber incident response plan that only exists in the system that has just been encrypted is not a plan. It is an unfortunate irony.
How to reduce the risk before the bad day arrives
This blog is about what to do after a cyber attack starts. But the easier win is to make the attack less likely, and make recovery less painful if it does happen.
Prevent common cyber attacks
Start with the basics that reduce the chance of a successful attack: MFA, patching, safer email, staff awareness and sensible security settings.
Protect Microsoft 365 data
Microsoft 365 data still needs backup. Deleted mailboxes, malicious deletion, ransomware and account compromise can all create recovery problems.
Back up servers and endpoints
If your business relies on servers, desktops or laptops, tested backup and recovery is one of the biggest differences between an incident and a disaster.
Reduce ransomware damage
Ransomware protection should include prevention, detection, isolation and recovery. No single tool is enough on its own.
Get managed cyber protection
Smaller organisations often need enterprise-grade monitoring without enterprise complexity. Managed protection helps spot and respond to threats earlier.
A quick first-hour checklist
Keep this simple enough for a non-technical person to follow.
- Stop using the affected device or account.
- Disconnect affected devices from Wi-Fi and network cables.
- Do not turn affected devices off unless you cannot isolate them any other way.
- Call your IT provider by phone.
- Call your cyber insurance provider before major changes or recovery attempts.
- Call your bank immediately if money has moved.
- Do not delete, wipe or reinstall anything yet.
- Use a clean device to change critical passwords.
- Report through NCSC, Report Fraud / Action Fraud, Police Scotland or ICO as appropriate.
Frequently asked questions
What is the first thing to do in a cyber attack?
Disconnect the affected devices from the network by unplugging network cables and turning off Wi-Fi. Do not turn them off unless you cannot isolate them any other way. Then call your IT provider by phone. The goal is to stop the incident spreading while preserving evidence.
Should I turn off a computer if I get ransomware?
If you can safely disconnect it from the network, do that first. Do not start wiping, reinstalling or turning devices off unless you have no other way to isolate them. Your IT provider or incident response team may need evidence from the device to understand what happened.
Should I call my cyber insurance provider?
Yes, if you have cyber insurance. Call them early, before major changes are made or recovery work begins. Some policies require an approved incident response team to be involved before IT support restores backups, wipes devices or rebuilds systems.
Should I pay the ransom?
The NCSC and UK law enforcement do not encourage, endorse or condone paying ransom demands. Payment does not guarantee recovery and may fund further attacks. Speak to your IT or incident response team, insurer and law enforcement before making any decision.
We sent money to a scammer. What should we do?
Call your bank immediately and ask whether the payment can be stopped, recalled or frozen. Then report the incident through the appropriate UK route. Speed matters with payment fraud.
Who do I report a cyber attack to in the UK?
For cyber incidents, report to the NCSC. For fraud or cyber crime in England, Wales or Northern Ireland, report through Report Fraud / Action Fraud. In Scotland, contact Police Scotland on 101. If personal data may have been exposed, assess whether the incident is reportable to the ICO.
Do small businesses really need an incident response plan?
Yes. It does not need to be long. A one-page plan with who to call, where backups are, what systems matter most and who can make decisions is enough to remove a lot of panic from the first hour.
Final thought
A cyber attack is stressful. That is exactly why the first steps need to be simple.
Disconnect. Do not turn it off unless you have to. Call your IT provider. Call your insurer. Preserve evidence. Report.
The businesses that recover best are not always the biggest. They are often the ones that had a plan, tested their backups, and knew who to call before the bad day arrived.
