01 / 03
Incident response specialists
Independent firms that can contain the attack, investigate what happened and help you recover.
Been hacked? Get help now
Dealing with a cyber incident right now? Start with the steps below. Then tell us what is happening and we will introduce you to independent incident response specialists.
Business Cyber Check introduces you to authorised insurers and brokers. We are not an insurer or broker and do not provide quotes or advice. Your enquiry may be shared with up to 3 of them.
Do these things now
Follow official guidance and your own plan first. These steps are general and do not replace advice from your insurer, incident response provider or lawyers.
- Follow your incident response plan if you have one, and bring in the people it names.
- Disconnect affected devices from the network (wired, wireless and mobile data) to stop the spread. Do not wipe them: they may hold evidence.
- If you have cyber insurance, call your insurer’s incident line first. It may be a condition of your cover, and your policy may give you access to incident response, legal and PR support.
- Report it. In England, Wales and Northern Ireland, an organisation under a live cyber attack can call Report Fraud on 0300 123 2040, 24 hours a day. In Scotland, call Police Scotland on 101. Significant incidents can also be reported to the NCSC.
- If personal data is involved, you may need to report the breach to the ICO without undue delay and no later than 72 hours after becoming aware of it.
- Reset passwords from a clean device, starting with email and administrator accounts, and make sure multi-factor authentication is on.
- Do not rush any decision about a ransom. Law enforcement does not encourage, endorse or condone paying ransoms. Talk to your insurer and legal advisers first.
- Keep a log of what happened, when, and every action you take. It helps specialists, insurers and regulators.
Sources: NCSC: recovering from a disruptive attack; NCSC with ABI, BIBA and IUA: considering a ransom payment; ICO: personal data breaches; Report Fraud.
Who we can introduce you to
02 / 03
Breach lawyers
Legal support on reporting duties, notices to people affected, regulators and contracts.
03 / 03
Authorised insurers or brokers
If you want cover once things are under control, we can introduce you to up to 3 of them. We don’t quote or give advice.
What people ask in an incident
Should we pay the ransom?
Do not rush the decision. Law enforcement does not encourage, endorse or condone paying ransoms, and paying does not guarantee you get your data back. Speak to your insurer, if you have cover, and to legal and incident response specialists before deciding anything.
Do we have to report a cyber attack?
It depends on what happened and who you are. If personal data is affected, UK GDPR may require you to tell the ICO within 72 hours of becoming aware. Sector regulators, contracts and your insurer may have their own rules. A breach lawyer can confirm what applies.
Can you help if we do not have cyber insurance?
Yes. We can introduce you to independent incident response specialists whether or not you have cover. Any work they do is agreed and paid for directly with them. Asking us for an introduction is free.
Who will contact us?
Business Cyber Check and, with your consent, up to 3 independent specialists. The partner list shows who they may be.