What to do if your business is hacked or scammed: the first steps
A practical first-hour checklist for a small business hit by a phishing attack, a hacked account, payment fraud or ransomware, and who to report it to.
By Logic NI3 min read
It will probably happen to your business at some point, in some form: a convincing fake invoice, a hacked mailbox, a device that suddenly behaves strangely. The National Cyber Security Centre (NCSC) says 1 in 2 small businesses suffer a cyber incident every year. What matters is what you do in the first hour. This guide is a practical checklist. It is general advice and no substitute for an IT professional on a serious incident.
First, stay calm and stop it spreading
| If this happened | First move |
|---|---|
| You clicked a phishing link or opened a bad attachment | Disconnect the device from the network and Wi-Fi. Do not switch it off if you are told to leave it running for investigation, but stop it connecting |
| An account has been hacked | From a different, trusted device, change the password and turn on two-step verification. Sign out of all sessions where the service allows it |
| You paid a fraudster | Phone your bank straight away and tell them. The sooner they know, the more they can do |
| Ransomware, files locked with a ransom note | Disconnect affected devices from the network and any shared drives. Do not pay without taking advice. Check your backups are unaffected |
| Your website is down or defaced | Contact your website provider or host immediately, and change admin passwords |
The next steps, in order
- Secure your accounts. Start with email, because it can be used to reset every other password. Change passwords from a clean device and use two-step verification.
- Tell the people who need to know. Staff, your IT or website provider, your bank if money is involved, and anyone you may have wrongly emailed from a hacked account.
- Check what has changed. Look for forwarding rules on mailboxes, new users, new devices signed in and unfamiliar payments.
- Keep a record. Note what happened, when and what you did. Screenshots help.
- Restore from backup if needed. This is where tested backups pay off. Restore to a clean device, not the infected one.
- Learn from it. Work out how it got in and close the gap.
Where to report
| What | Where |
|---|---|
| Cyber crime and fraud | The UK government's signposting service at gov.uk/report-cyber, which the NCSC links to |
| Personal data breach | The ICO. There can be a legal duty to report a breach that is likely to risk people's rights, generally within 72 hours of becoming aware. Check the ICO's guidance |
| Money lost | Your bank, immediately |
| Insurance | Your insurer, if you have cyber cover. Check the policy for notification deadlines |
What the NCSC covers
The NCSC publishes advice for sole traders and small organisations on:
- phishing;
- business payment fraud;
- hacked accounts;
- ransomware attacks;
- infected devices;
- denial of service attacks.
It is a good place to go for step-by-step instructions on the type of incident you face.
Before it happens
| Do this | Why |
|---|---|
| Turn on two-step verification for email and key services | Stops many account takeovers even when a password leaks |
| Back up important data, and test restoring it | A backup you have never restored is a hope, not a plan |
| Keep software updated | Attackers use known weaknesses |
| Agree a payment-change rule | Phone to confirm any change of bank details, using a number you already have |
| Write down who to call | Your IT or website provider, bank and insurer, somewhere you can find it when email is down |
Where Logic NI fits
For websites and systems we build and run, we keep them updated, backed up and access-controlled, and we are the first call if something looks wrong with them. See managed support, website maintenance or contact us. For wider help with your office devices and accounts, speak to an IT support provider.