Browse tools

Cyber Incident First-Hour Guide

Something has gone wrong. Take a breath: you're in the right place. Pick what's happened and follow the checklist. Each tick is time-stamped in an incident log you can export or print for your IT support, insurer, the police or the ICO.

What's happened?

Choose the closest match. You can switch at any time, and your ticks are kept for each one.

If anyone is in danger, or a crime is happening right now, call 999. Organisations under a live cyber attack can call Report Fraud on 0300 123 2040 at any time, day or night (in Scotland, Police Scotland on 101).

Your emergency contacts

Fill these in now, before you need them. They're saved in this browser only and appear in the checklists and printouts.

Official UK contacts

    Do I need to report a personal data breach?

    Under UK GDPR you must tell the Information Commissioner's Office (ICO) about a personal data breach within 72 hours of becoming aware of it, unless it's unlikely to result in a risk to people's rights and freedoms. Answer these questions for a quick steer.

      This is a guide, not legal advice. The ICO's own self-assessment gives an official steer, and its guidance is being updated for the Data (Use and Access) Act 2025, so check ico.org.uk for the latest.

      Incident log

      Write down what you see, what you do and what you decide, as you go. Investigators, insurers and the ICO will ask for this. Times are your device's local time.

        Nothing logged yet. Ticks from the checklists and your notes will appear here.

        The first hour: the golden rules

        • Contain, don't destroy. Disconnect affected devices from the network, but don't wipe, rebuild or switch them off unless your IT support says so. Evidence helps you find out how it happened and stop it happening again.
        • Use a clean channel. If email or Teams might be compromised, talk by phone or in person.
        • Write it down. Times, what you saw and what you decided. A clear log saves hours later.
        • Call for help early. Your IT support, your cyber insurer's helpline (many policies require you to call first) and your bank if money is involved.
        • Don't pay criminals or negotiate without expert advice.

        Get ready before it happens

        • Fill in your emergency contacts above and print this page, so you have it when the computers are down.
        • Keep backups that ransomware can't reach (offline or immutable), and test that you can restore them.
        • Turn on multi-factor authentication for every account, and agree a call-back rule for any change to bank details.
        • Use our IT Policy Generator for an incident reporting policy, and our Cyber Essentials Checker to close the most common gaps.

        Your data stays with you

        • Your contacts, ticks and log are saved in this browser's local storage, not on our server.
        • Anyone using this browser profile can see them, so use a work device and export the log for safe keeping.
        • Clearing your browser data, or using a private window, will remove them.

        Sources

        More free tools