Think you've been hacked? What to do now

First, in the next few minutes

Don't panic, and don't delete anything. Emails, messages and files are evidence.
Have cyber insurance? Call its incident line first. Many policies need you to.
Money has left your account? Call your bank now on the number on your card, or dial 159.
Have an IT provider? Call them now.
Report cyber crime to Report Fraud at reportfraud.police.uk or 0300 123 2040. In Scotland, call Police Scotland on 101.

What's happened?

Choose the closest match for a checklist of what to do.

What's happened?

An email or online account has been taken overStrange emails sent from it, a password that no longer works, or someone entered a password on a fake pageFiles are locked or there's a ransom messageFiles won't open, names have changed, or a message demands paymentWe've paid a fake invoice or changed bank detailsMoney sent to a criminal's account after a fake email or callA laptop, phone or tablet is lost or stolenAny device used for work email or business dataPersonal data was sent to the wrong person or leakedAn email to the wrong address, a lost file, or data seen by someone who shouldn'tOur website has been hackedDefaced pages, strange redirects, or a warning from your host or GoogleSomeone clicked a suspicious link or attachmentNot sure whether anything happened yet

Do you need to tell the ICO?

Under UK GDPR, a personal data breach must be reported to the ICO within 72 hours of you becoming aware of it, unless it's unlikely to put people at risk.

Was personal data involved?

Anything about a person: customers, staff, contacts. Names, emails, addresses, bank or health details.

YesNoNot sure

When did you find out?

Who to contact

Your bankThe number on your card, or 159 to reach most UK banks safely.

Report FraudEngland, Wales and Northern Ireland: report online or 0300 123 2040.

Police ScotlandIn Scotland, call 101, or 999 if a crime is in progress.

The ICOReport a personal data breach online or call 0303 123 1113.

Phishing emails and textsForward emails to report@phishing.gov.uk, and texts to 7726.

Your cyber insurer and IT providerKeep their incident numbers somewhere you can reach if your email is down.

Keep a record as you go

Write down what happened, when, and what you did. Your insurer, the police and the ICO will ask. Notes are saved only in this browser.

Incident notes

This is general guidance for small businesses, based on NCSC and ICO advice. It isn't legal advice, and Brightlock Cyber isn't an incident response service. For a serious attack, get help from your IT provider, insurer or an NCSC-assured incident response company.

Stop it happening again.

Most incidents start with a gap the free health check would find.

Take the free health check