What to Do in the First 24 Hours of a Cyber Attack
Cybergen InsightsCREST-certified security team
|
|
11 min read
It usually starts with something small. A file that will not open. A colleague who cannot log in. A message on screen telling you your data has been encrypted and giving you a deadline. In the next few minutes, your organisation will make decisions that shape the rest of the incident: how much damage is done, how much evidence survives and how quickly you recover.
Most of the costly mistakes in a cyber attack are made in the first day, not because people panic, but because they act on instinct. They switch everything off, wipe the infected laptop, restore from backup straight away or keep talking on an email system the attacker can read.
This guide sets out what to do in the first 24 hours after a cyber attack, hour by hour: how to contain the damage without destroying evidence, who to call, what to report and when, and how to talk to the people who depend on you. At the end there is a checklist you can print and keep with your incident plan.
Select a stage to see what should be happening
Hour One: Contain Without Destroying Evidence
The goal of the first hour is to stop the attack spreading while keeping the evidence you will need later. Those two aims can pull in opposite directions, so it helps to know the right moves in advance.
Isolate, do not switch off. Disconnect affected machines from the network by unplugging the cable or disabling Wi-Fi, but leave them powered on. Memory can hold valuable evidence, such as encryption keys, running processes and network connections, that is lost the moment a machine is turned off.
Cut off the attacker's access. Disable accounts you believe are compromised, revoke active sessions and reset passwords for privileged accounts, ideally from a device you know is clean. If remote access or a particular server is the obvious way in, take it offline.
Protect your backups. Attackers often go after backups first. If backup jobs are scheduled, consider pausing them so infected or encrypted files do not overwrite your last good copies.
Start a log. Name one person to lead the response and write down every decision, action and time from now on. It feels slow in the moment. It will be invaluable for your insurer, your regulators and your own lessons learned review.
Assume they are listening. If your email or chat platform may be compromised, move incident conversations to a separate channel, such as phone calls or a messaging group on personal devices, until you know it is safe.
Who to Call: Internal, Insurer, Incident Response, Legal
Nobody should handle a serious incident alone, and the order you make the calls in matters.
Who needs to hear about it, and in what order
Immediately
The people who make decisions in the first hourWithin the first few hours
The people who protect your position and bring expertiseAs the facts become clear
Authorities, then the people affectedInternally, bring together a small group with the authority to make decisions quickly: the incident lead, IT and security, and a senior leader who can approve spending, shutdowns and communications. Keep it small. Large calls in the first hour slow everything down.
Your cyber insurer should hear from you early. Many policies require prompt notification and give access to a breach line with approved incident responders and legal advisers. Engaging suppliers before you call them can affect what the policy covers, so read your policy now, before you need it.
An incident response provider brings people who handle these situations every week. They can investigate how the attacker got in, confirm what they touched and guide containment so you do not tip the attacker off or destroy evidence. Having a provider agreed in advance, through an incident response retainer, saves precious hours.
Legal counsel and your data protection officer help you decide what must be reported, to whom and when, and manage the risk of claims. Involving lawyers early can also help keep sensitive investigation findings protected.
What to Preserve and What Not to Touch
The instinct to clean up and get back to normal is strong. Resist it until evidence has been captured. Without it, you may never know how the attacker got in, which means you cannot be sure they are gone.
Preserve
- Affected machines, isolated but powered on where possible
- System, firewall, VPN, email and cloud logs, exported early
- Ransom notes, suspicious emails and their headers
- Screenshots of anything unusual, with times noted
- A running log of every decision and action taken
Do not touch
- Wiping or rebuilding systems before evidence is captured
- Running antivirus scans that delete the attacker's files
- Contacting the attacker or paying anything
- Discussing the incident on email or chat the attacker may be reading
- Restoring from backups you have not checked are clean
The most important evidence is often in logs: firewall, VPN, email, identity platform, cloud services and endpoint protection. Many of these only keep data for a short time, so export them early. Ransom notes and suspicious emails should be kept with their full headers, not forwarded around the business.
The same applies to recovery. Restoring from backup is the right goal, but only once you know the backup is clean and the way in has been closed. Restoring too early can bring the attacker straight back, sometimes within hours. Our cyber recovery testing playbook explains how to prove your backups will work when you need them.
Reporting: ICO, Report Fraud and Sector Regulators
Reporting is not just a legal duty. It brings help, intelligence and, in some cases, protection from bigger penalties later. Here are the main UK routes.
| Who | When | How |
|---|---|---|
| Information Commissioner's Office (ICO) If personal data is affected and there is a risk to people | Within 72 hours of becoming aware | Online form or phone, via ico.org.uk |
| Report Fraud England, Wales and Northern Ireland. Replaced Action Fraud | As soon as practical | reportfraud.police.uk or 0300 123 2040 |
| Police Scotland Organisations in Scotland | As soon as practical | 101 |
| NCSC Significant incidents, and support for the wider picture | As soon as practical | report.ncsc.gov.uk |
| Sector regulator For example under the NIS Regulations, or FCA rules | Often within 72 hours, check your own rules | The regulator's own reporting route |
The ICO. If personal data is involved and the breach is likely to result in a risk to people's rights and freedoms, UK GDPR requires you to report it to the Information Commissioner's Office within 72 hours of becoming aware. You do not need all the facts. Report what you know, explain what you are doing and add detail as you learn more. If you decide not to report, record why.
Report Fraud. In England, Wales and Northern Ireland, Report Fraud replaced Action Fraud as the national service for reporting cyber crime and fraud. It went live on 4 December 2025, run by the City of London Police. In Scotland, report to Police Scotland on 101.
The NCSC. The National Cyber Security Centre takes reports of significant cyber incidents, and its incident management guidance is worth reading before you ever need it.
Sector regulators. Operators of essential services and relevant digital service providers must notify their competent authority under the NIS Regulations, without undue delay and within 72 hours. Financial services firms have their own duties to the FCA and PRA. Contracts with customers and public bodies often carry notification deadlines too.
Change is coming. The Cyber Security and Resilience (Network and Information Systems) Bill would widen the range of organisations covered, bring in key suppliers such as managed service providers and introduce faster reporting, with an initial notification within 24 hours. It completed its House of Lords stages on 2 November 2026 and has returned to the Commons for MPs to consider the Lords amendments. It is not yet law, so check its status when you review your plan.
On ransom payments, the UK government has announced plans to ban payments by public sector bodies and critical national infrastructure and to require others to notify the government before paying. Neither measure is law yet, and law enforcement advises against paying in any case.
Communicating With Staff, Customers and Suppliers
Silence fills with rumour. Within the first day, people inside and outside the organisation will notice that something is wrong. A short, honest message beats a long, perfect one that arrives too late.
- Staff first. Tell them what has happened in plain terms, what they should and should not do (for example, not to log in to certain systems or discuss it on social media) and where updates will come from.
- Customers when it affects them. If services are down or their data may be involved, a holding statement acknowledging the issue and promising updates protects trust far better than saying nothing. If a breach is likely to result in a high risk to them, UK GDPR requires you to tell them without undue delay.
- Suppliers and partners. If they connect to your systems, they need to know so they can protect themselves, and they may spot related activity on their side.
Prepare templates for these messages before an incident, agree who approves them and practise using them. A tabletop exercise is the best way to find out whether your communications plan survives contact with a real scenario.
A Printable First 24 Hours Checklist
Use this checklist during an incident, or work through it now to see what is already in your plan. You can copy it or print it, and we recommend keeping a paper copy somewhere you can reach if your systems are down.
The first 24 hours, step by step
Work through the list during an incident, or tick what you already have planned.
Nothing you tick is sent or stored. Print it now and keep a copy offline with your incident plan.
How Cybergen Can Help
The best time to prepare for the first 24 hours is long before they start. We help organisations get ready and respond fast when it matters:
- Incident response to contain attacks, investigate what happened and guide recovery
- Tabletop exercises and crisis simulations so your leadership team has rehearsed the decisions in this guide
- Business continuity and disaster recovery planning that includes cyber scenarios
- 24/7 managed detection and response to spot intruders early, often before the damage starts
If you are dealing with an incident right now, call us on 01865 950828 or contact us. If you want to be ready for one, we can help you build and test your plan.
Reporting routes, the Cyber Security and Resilience Bill and the proposed ransomware payment ban are subject to change. This guide reflects the position as at 8 November 2026.
Frequently Asked Questions
Should we pay a ransom?
Law enforcement and the NCSC advise against paying. Payment does not guarantee you will get your data back or that stolen data will be deleted, and it can mark you as a willing payer. Paying a sanctioned group can also be illegal. The UK government has announced plans to ban payments by the public sector and critical national infrastructure. Take legal advice and involve your insurer before any decision.
When does the ICO 72-hour clock start?
From the moment you become aware of a personal data breach, which the ICO describes as having a reasonable degree of certainty that a security incident has led to personal data being compromised. You do not need every detail to report. You can submit what you know and add more later.
Should we turn off infected computers?
Usually not. Switching off can destroy evidence held in memory. Disconnect affected machines from the network instead, by unplugging the cable or disabling Wi-Fi, and leave them powered on until your incident responders advise otherwise.
Do we have to tell our customers?
If a breach is likely to result in a high risk to people's rights and freedoms, UK GDPR requires you to tell them without undue delay. Contracts may also require you to notify customers or suppliers within set timescales. Check both early, so you are not caught out.
Does the Cyber Security and Resilience Bill change any of this?
Not yet. The Bill has cleared the House of Lords and is back in the Commons for the final stages, but it has not received Royal Assent. As introduced, it proposes an initial notification within 24 hours and a fuller report within 72 hours for organisations in scope, which would tighten timelines for regulated sectors and key suppliers. Check its status when you update your plan.
Sources
- ICO: Report a breach
- ICO: Personal data breaches, a guide
- NCSC: Report a cyber incident
- NCSC: Incident management
- Report Fraud
- City of London Police: Report Fraud service goes live (December 2025)
- UK Parliament: Cyber Security and Resilience Bill
- UK Parliament: Lords completes examination of Cyber Security and Resilience Bill (November 2026)
- The Network and Information Systems Regulations 2018, regulation 11
CREST-certified consultants with over 100 years of combined experience in threat intelligence, penetration testing, MDR and compliance.
