In short
- ✓Don't panic and don't pay a ransom. Isolate affected devices but don't wipe them.
- ✓Change passwords from a clean device, sign out all sessions and turn on MFA.
- ✓Call your bank immediately if money has been sent.
- ✓Report personal data breaches that risk harm to the ICO within 72 hours.
- ✓Report cyber crime to Report Fraud (England, Wales and Northern Ireland), which replaced Action Fraud.
Signs your business has been hacked
- Customers or suppliers receive odd emails or invoices that appear to come from you.
- You can't log in, or passwords have changed without you doing it.
- Files are encrypted or renamed, with a ransom note.
- Unknown forwarding rules, new admin accounts or unfamiliar sign-in locations appear in Microsoft 365 or Google Workspace.
- Money has been paid to an account you don't recognise.
The first hour: step by step
- Disconnect affected computers from the network and Wi-Fi, but leave them switched on and don't wipe them. They hold evidence.
- If email is compromised, change the password from a different, clean device, sign out all sessions and turn on multi-factor authentication.
- Check for and remove mailbox forwarding rules and any new admin accounts you didn't create.
- If money has moved, call your bank straight away. The sooner they act, the better the chance of recovering it.
- Don't pay a ransom. UK police and the NCSC advise against it, and payment doesn't guarantee your data back.
- Note what happened and when: screenshots, times and who noticed what.
- Call your cyber insurer if you have one, as many policies include incident response help.
- Get specialist help to find out what was accessed and close the way in.
Who to report a cyber attack to
- The ICO: if personal data is involved and the breach is likely to risk people's rights and freedoms, report it within 72 hours of becoming aware of it.
- Report Fraud (reportfraud.police.uk, 0300 123 2040): the national service for reporting cyber crime and fraud in England, Wales and Northern Ireland, which replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101.
- Your insurer, your bank and, where appropriate, customers whose data or payments are affected.
After the incident
Once you're back up and running, fix the weakness that let the attacker in, usually missing MFA, an unpatched system or a phishing email, and test your backups. A short review after the incident turns a bad day into a stronger business.
Questions
Should I turn off a computer that's been hacked?
Disconnect it from the network and Wi-Fi but leave it switched on if you can. Turning it off or wiping it can destroy evidence that shows what the attacker did.
Is Action Fraud still the place to report cyber crime?
No. Action Fraud was replaced by Report Fraud in December 2025. Use reportfraud.police.uk or call 0300 123 2040 in England, Wales and Northern Ireland.