Minutes 0–15: contain it
- Stay calm and write things down: what you saw, when, and on which device.
- Disconnect affected devices from the network (unplug the cable, turn off Wi‑Fi). Don't switch them off — that can destroy evidence investigators need.
- Don't pay, reply to or negotiate with anyone demanding money.
- Call your IT support and tell them it's a security incident.
Minutes 15–45: secure accounts
- From a clean device, reset passwords for affected accounts, starting with email and admin accounts.
- Sign out all sessions and check MFA methods haven't been changed.
- Check mailboxes for new forwarding or inbox rules.
- If money may have been sent, call your bank now (159 reaches most UK banks).
Minutes 45–60: tell the right people
- Your cyber insurer, if you have cover. Many policies require prompt notification and provide an incident response team.
- Report Fraud (reportfraud.police.uk, 0300 123 2040) for cyber crime and fraud.
- The ICO, if personal data may be affected and there's a risk to people. UK GDPR requires notification within 72 hours of becoming aware of a reportable breach.
- The Wales Cyber Resilience Centre offers support and guidance to Welsh organisations.
- Staff: a short, factual message about what to do and not to do.
After the first hour
Recovery means restoring from clean backups, finding how the attacker got in and closing that door, and learning lessons. That's why tested backups and MFA matter so much before anything happens.
Need help now? Contact us.
