What to Do When Ransomware Locks Your Business in the United Kingdom

UNITED KINGDOM — If ransomware locks your company’s files or systems, treat it as a live cyber incident. Disconnect affected devices from wired, wireless and mobile networks to help stop the spread. Notify your IT support or cyber incident-response provider immediately. Protect offline backups, preserve relevant evidence and use a clean device to report the incident. If your business, charity or organisation is under an active cyber attack in England, Wales or Northern Ireland, call Report Fraud on 0300 123 2040; its live cyber attack response route is available 24/7.

A ransomware incident may include more than encryption. Attackers may have copied customer data, employee records, financial details or business documents before displaying a demand. Do not assume that paying will recover the files, prevent a leak or make the network safe. The UK’s National Cyber Security Centre (NCSC) and law enforcement do not encourage, endorse or condone ransom payment.

12 immediate actions — ransomware incident checklist

Recognise the incident and declare an emergency. Files that suddenly cannot open, a ransom note, widespread account lockouts or suspicious mass encryption require immediate investigation.
Isolate affected devices from networks. Disconnect wired Ethernet, Wi-Fi and mobile connections as instructed by NCSC; ask IT to assess whether wider network isolation is necessary.
Do not spread the infection through shared drives or backups. Stop unsafe connections to servers, storage and remote-access systems while the response is organised.
Contact IT and qualified incident responders. Use an independent phone or trusted device, not email or chat accounts that may already be compromised.
Protect evidence. Record the time of discovery, affected systems, ransom messages and relevant logs; follow specialist advice before wiping or rebuilding computers.
Protect privileged credentials. Ask responders to assess admin accounts, password resets, compromised sessions and multi-factor authentication without locking your recovery team out.
Determine whether essential operations are unsafe. Stop affected payment, booking, customer-service or clinical processes and use approved manual contingencies where practical.
Report an ongoing organisational cyber attack. In England, Wales and Northern Ireland, call 0300 123 2040; in Scotland, contact Police Scotland, usually on 101.
Notify the NCSC through its official cyber incident report service. Use a separate clean device; an NCSC report does not automatically satisfy statutory regulatory notifications.
Assess personal data and legal duties immediately. Under UK GDPR, a reportable personal data breach must be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness.
Do not trust the ransom demand. Do not transfer money or contact the attackers on your own; obtain legal, financial and technical advice, including sanctions considerations.
Recover only from known-clean systems and backups. Rebuild and verify the environment, restore operations in priority order and continue monitoring for reinfection.

If this is happening now, start containment and professional response before reading the full article. A business should not spend the first hour debating blame or rewriting website copy while attackers may still have access.

What ransomware actually does to a business

Ransomware is malicious software or an attack process that makes files or systems inaccessible, typically by encryption. Attackers often display a demand for payment in exchange for a possible decryption tool or promise not to release stolen information. Sometimes the malware is designed to destroy data rather than restore it.

The NCSC warns that there is no guarantee a payment will return data or remove malicious software. The attacker may have obtained credentials, compromised other devices, changed security settings and created additional access paths. Even a working decryptor would not automatically undo those problems.

A sole trader may lose access to invoices and customer orders. A retailer might be unable to process payments or dispatch products. A professional practice may lose access to appointments, client files and communications. A school or charity may have sensitive personal data and safeguarding responsibilities. The consequences are operational, financial, privacy-related and reputational.

The first objective is to stop further harm. The second is to understand the scope, protect people and comply with legal duties. The third is to restore essential services from clean systems. Trying to do all three without coordination can make the problem worse.

Isolate the infection, but do not destroy essential evidence

NCSC’s ransomware response instructions begin with immediately disconnecting affected computers, laptops and tablets from all network connections. That includes Ethernet cables, Wi-Fi and mobile-data connections. An infected laptop that remains connected to shared storage or a virtual private network may allow the incident to spread.

In a serious outbreak, NCSC says organisations may need to disable core connections or the wider network. That decision should account for safety-critical functions and the technical environment. A small office may be able to unplug a compromised laptop; a hospital or industrial site must coordinate isolation with the responsible safety and technology teams.

Isolation is different from wiping. Wiping the affected computer too early may destroy logs, malware samples or clues about how the attacker entered. Professional incident responders may need forensic images or other preserved evidence before rebuilding. Where the risk of active spread is severe, follow urgent containment instructions while recording what was done and when.

Avoid connecting a backup drive, clean laptop or employee’s personal computer to the compromised network merely to see whether files can still be copied. That may expose additional devices or backup data to the attacker.

Tell staff not to forward ransom attachments, install unknown recovery tools or run software sent by somebody claiming to be an emergency helper. Use a trusted communications channel to distribute instructions and preserve the original incident records under appropriate access control.

Build a small incident command team

A small business may not have a dedicated security department. Assign clear roles anyway. One person should coordinate containment and contact the managed IT provider. Another should assess customers, staffing, records and essential services. A senior decision-maker should handle legal and financial escalation and keep a written decision log.

Do not let every employee attempt independent fixes. One person disabling a network while another restores it or changes credentials can frustrate containment. The business needs a single current account of which systems are affected and what actions are authorised.

Use a clean phone, separate computer or another communications channel that does not depend on the compromised company network. An attacker who has access to corporate email or internal messaging may be able to read incident discussions, impersonate colleagues or interfere with response plans.

Create an incident log with the discovery time, affected devices, people contacted, evidence preserved, network isolation actions, customer impact and next decisions. This supports technical troubleshooting and later regulatory or insurance explanations.

Ask the IT provider whether an independent cyber incident response firm is necessary. NCSC publishes information about assured professional responders, and the correct level of support depends on the severity, scale and capabilities of the organisation.

The first hour: a practical sequence for a small office

A receptionist discovers that appointments are inaccessible. An employee sees a note asking for cryptocurrency. Several folders have unfamiliar extensions. The manager should not pay immediately or ask all employees to restart their computers.

First, tell the IT lead and disconnect clearly affected devices from networks. Report whether systems are still being encrypted or shared drives are changing. Preserve the details of the ransom message and affected filenames without opening suspicious attachments.

Second, assess business safety. Can staff continue to work without exposing customer data or making false bookings? If there is a direct hazard to health, finance or operations, stop the unsafe activity and use the organisation’s established contingency plan.

Third, protect backups. Determine whether offline or immutable copies exist and whether any backup service is still connected to the affected environment. Do not assume the newest backup is safe simply because it completed recently.

Fourth, initiate reporting and legal assessment. In England, Wales and Northern Ireland, a business experiencing a live cyber attack can call Report Fraud on 0300 123 2040, available 24/7 for this situation. Consider reporting to NCSC separately and evaluating ICO obligations immediately.

Finally, inform staff about safe communications and the expected operational status. A short factual notice is better than a false promise that everything will be restored by a particular time.

The UK reporting routes in 2026

The national reporting platform for cyber crime and fraud in England, Wales and Northern Ireland is Report Fraud, replacing the former Action Fraud service. It directs organisations experiencing a live attack to telephone 0300 123 2040 immediately, with the live cyber-reporting service available around the clock.

In Scotland, fraud and cybercrime reports should normally go to Police Scotland on 101, according to the current Report Fraud service. If a crime creates an immediate physical danger or another emergency, call 999.

The National Cyber Security Centre provides an official Report a Cyber Incident service. NCSC may share relevant information with law-enforcement partners to support investigation and wider cyber defence. Its report form specifically says to use a device and network not believed to be compromised.

NCSC states that a report through its service does not itself satisfy any legal or regulatory reporting duty. Organisations may need to report the same incident separately to the Information Commissioner’s Office, a financial-sector regulator, a sector-specific authority or another body depending on their activities.

Do not assume that a police crime reference is a substitute for an ICO personal-data-breach notification. The police, NCSC and ICO have different responsibilities. A compliant response may require several distinct reports.

What does the ICO’s 72-hour rule really mean?

Under the UK General Data Protection Regulation, organisations must notify the Information Commissioner’s Office (ICO) of a personal data breach that is likely to pose a risk to people’s rights and freedoms. The report must be made without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

The duty is not limited to cases where an attacker has published personal information. The ICO’s ransomware guidance explains that encryption can affect the availability of personal data and may constitute a personal data breach even without confirmed exfiltration. The organisation must assess likely risk to individuals rather than assuming that no visible leak means there is nothing to consider.

If a breach is unlikely to risk people’s rights and freedoms, ICO notification may not be necessary, but the organisation should document the incident and its assessment. If the impact is likely to create a high risk to individuals, affected people must normally be informed without undue delay, following the law and ICO guidance.

Do not wait until the investigation is completely finished before making a notification when it is already required. The ICO says an initial report can include the information available and be supplemented later. Waiting for perfect certainty until after a deadline can create an avoidable compliance problem.

The clock is tied to awareness of a relevant personal data breach, not necessarily the moment that every detail of the attack becomes known. Record the time the issue was detected and when the organisation became aware of the breach, and obtain qualified data-protection advice on the applicable duties.

Examples of personal data at risk

Customer names, addresses, phone numbers, order histories or account details.
Employee payroll records, bank details, national insurance identifiers and employment histories.
Client case notes, education records, contracts and confidential correspondence.
Health, safeguarding or other particularly sensitive records where held.
User authentication data, password hashes, recovery tokens and access logs.
Business information whose loss of availability directly affects people receiving essential services.

A breach can cause loss of confidentiality, integrity or availability. Data may be stolen, altered or rendered inaccessible. Assess who could be harmed and how, including fraud, financial loss, identity theft, discrimination or inability to access an essential service.

If a ransomware incident affects a school, care provider or clinic, the potential impact may go beyond ordinary inconvenience. The correct response may need urgent sector-specific safeguarding and continuity measures as well as the general cyber incident process.

Should a business pay the ransom?

NCSC and UK law enforcement do not encourage, endorse or condone ransomware payments. The NCSC explains that payment does not guarantee access to data, does not establish that malicious software has been removed and may increase the likelihood of future attacks. Some criminals demand more after payment.

There are also legal and sanctions considerations. UK government guidance warns that paying a designated person or organisation could violate financial sanctions, and a ransom payment may breach other applicable rules. Do not treat cryptocurrency payment as automatically lawful or safe because a payment system allows it.

If a ransom demand has been received, preserve the message and involve the organisation’s authorised leadership, legal adviser and professional incident response team. Do not let an individual employee negotiate or pay from a personal account. Never share administrator passwords or recovery credentials with someone claiming to be a helpful intermediary.

Report Fraud and NCSC can provide reporting routes and help inform the response. A professional recovery plan focuses on containment, evidence, clean restoration and reducing damage rather than assuming the attacker will honour a promise.

Backups: why they are critical and why restoring too soon is dangerous

A good backup system can make the difference between a manageable disruption and a prolonged loss of operations. NCSC advises using backups that are protected from ransomware, including offline copies or other arrangements attackers cannot easily modify.

But the existence of a backup is not proof that it is clean. An attacker may have compromised the organisation days or weeks before encrypting files. A recent backup could contain malware, stolen credentials, unauthorised accounts or another foothold.

NCSC instructs organisations to make sure the device and backup used for restoration are free from infection. Recovery may involve rebuilding systems, installing and updating software, checking antivirus results, restoring data and monitoring the environment before ordinary connections resume.

Do not reconnect every restored computer to the original network at once. A staged approach allows responders to test essential functions, verify security and detect renewed suspicious activity. Prioritise functions that maintain safety and necessary business operations.

The NCSC describes reinstalling the operating system on infected devices as part of a safe recovery process. Professional advice is especially important before erasing devices containing evidence or systems subject to regulatory or record-keeping requirements.

Credentials, identity and compromised staff accounts

An attacker may have logged in using a stolen password, exploited an insecure service or obtained administrator access. Simply reinstalling one laptop will not necessarily disable the stolen credentials. NCSC advises resetting credentials, particularly administrator and system accounts, while making sure legitimate responders do not lock themselves out of recovery systems.

A safe password reset plan should prioritise the accounts that control identity, backups, cloud platforms, servers and remote access. Use a clean device and verified administrator channels. Review unexpected sign-ins, new accounts, forwarding rules and remote sessions.

Multi-factor authentication can reduce some account-takeover risks, but it is not a substitute for checking who already has active sessions or tokens. Responders may need to revoke stolen credentials and inspect accounts rather than assuming a fresh password alone ends the incident.

Tell employees not to approve unsolicited authentication requests or respond to messages claiming to be from the emergency IT team without independent verification. Attackers sometimes use confusion during an incident to obtain additional access.

Communication with customers and staff

A business should communicate clearly but avoid unsupported claims. If the booking system is unavailable, explain how customers can contact the company safely. If payments are suspended, state which authorised channels remain valid. If staff are told to use a contingency process, specify the correct tools and data-handling restrictions.

Do not announce that no personal data was stolen before the forensic investigation supports that conclusion. Equally, do not claim every customer is affected merely because a server is encrypted. State known facts, uncertainty and the actions being taken.

Where the UK GDPR high-risk threshold for notifying affected people is met, provide notices without undue delay and in accordance with ICO advice. People may need to be warned about phishing or identity fraud and given appropriate protective steps.

Use communications that attackers cannot easily hijack. Check official domain security, website content, social accounts and customer support numbers before distributing messages. An attacker-controlled mailbox could send fraudulent “recovery” instructions that cause further harm.

Avoid sending sensitive client files through employees’ personal email accounts as an improvised workaround. A manual continuity process must still respect confidentiality and the organisation’s legal obligations.

What if customers send urgent orders while systems are down?

A small retailer may have orders to dispatch but cannot access the system. Do not accept card details through an unapproved chat group or spreadsheet. If payment and shipping information cannot be verified securely, pause the affected activity and communicate an alternative.

A school, clinic or charity may hold records needed for a time-sensitive service. Use established emergency and business-continuity plans where possible, and notify relevant authorities or safeguarding contacts if service interruption creates immediate risks.

Not every business can continue safely with paper forms or temporary cloud tools. Evaluate whether staff have enough accurate information, privacy controls and access to prevent mistakes. A short service suspension may be safer than accepting financial or medical decisions based on corrupted records.

Do not blame frontline staff for delays while the incident response is still underway. Give them a simple script for referring urgent cases to a designated manager and for handling suspicious calls or messages.

The importance of preserving a decision log

Record the first observed time, affected systems, ransom note, network isolation, relevant files, account changes and who performed each action. Save original evidence securely with access restricted to the response team. Professional responders may require logs that ordinary staff cannot interpret.

A decision log helps explain later why a system was shut down, why one service was restored before another, and why an ICO notification was or was not made. It also supports insurance and police reporting without requiring employees to reconstruct several stressful days from memory.

Do not alter logs to make the organisation appear better prepared or to remove embarrassing details. An accurate record is more useful to incident responders and regulators than a polished but incomplete story.

Keep personal data exposure to the minimum necessary during investigation. Evidence that contains customer records should still be stored and shared securely.

Four common ransomware situations

A sole trader opens a laptop and sees encrypted invoices

Disconnect the laptop from networks immediately, avoid plugging in backup drives, contact trusted IT assistance and preserve the ransom message. Report the incident using the appropriate UK cybercrime route. Evaluate whether customer personal data was affected and whether an ICO report is required.

A charity loses access to donor and employee records

Isolate affected systems, engage its IT provider, protect backups, assess both confidentiality and availability of personal data, and decide urgently on ICO reporting. Inform trustees and relevant people through appropriate channels and preserve a clear incident log.

A small business receives a message threatening to publish customer details

Treat data exfiltration as a possibility requiring investigation, even if no public leak has yet appeared. Secure accounts, preserve the threat and obtain specialist incident response and legal guidance. Assess potential harm to individuals and reporting obligations rather than simply debating ransom payment.

A company successfully restores a backup and wants to reopen immediately

Verify the backup and rebuilt systems are clean, address the original access weakness, reset compromised credentials and monitor the network. A successful file restore does not prove the attacker has lost access or that no personal data was copied.

Common mistakes that make ransomware incidents worse

Do not leave clearly infected devices connected to shared networks.
Do not connect your only clean backup to an infected machine.
Do not wipe every system before preserving essential evidence and consulting responders.
Do not assume paying will restore data or stop extortion.
Do not confuse a Report Fraud or NCSC report with an ICO notification.
Do not automatically notify the ICO of every harmless technical alert without assessing whether a personal data breach occurred and its risk.
Do not wait for a complete forensic report when the 72-hour breach notification duty already applies.
Do not use compromised corporate email for confidential response coordination.
Do not blindly trust a restored backup without checking for reinfection.
Do not reopen insecure services merely to meet an unrealistic customer deadline.

A prevention plan for the next incident

Maintain offline, immutable or otherwise protected backups and test restoration regularly.
Use strong, unique administrator credentials and appropriate multi-factor authentication.
Keep operating systems, applications and security tools patched.
Restrict administrative privileges and remote access to what is necessary.
Practise a short incident response plan with assigned decision-makers and contact details.
Keep an offline list of IT, legal, cyber insurance, bank, NCSC and police reporting contacts.
Know which systems hold customer, employee and sensitive personal data.
Set up logging and monitoring so suspicious activity can be identified quickly.
Prepare a clean communication channel and manual continuity process for essential services.
Review data protection and sector-specific reporting obligations before a crisis.
Teach staff how to report unusual encryption, ransom notes and unexpected account activity.
After each incident or exercise, improve the controls and update the written plan.

Frequently asked questions

What should I do first if ransomware locks my UK business?

Immediately isolate affected devices from networks and contact a trusted IT or incident-response provider. Protect backups and use a separate clean device for reporting and coordination.

What number reports a live ransomware attack in England, Wales or Northern Ireland?

0300 123 2040 through Report Fraud. Its reporting service for organisations under a live cyber attack is available 24/7.

What about a business in Scotland?

Report fraud or cybercrime to Police Scotland on 101 as directed by the relevant reporting guidance. Use 999 for an immediate physical emergency.

Do I have to tell the ICO within 72 hours?

A personal data breach likely to pose risk to individuals must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness. Not every incident meets the notification threshold, but all personal data breaches should be documented and assessed.

Does encryption count as a personal data breach without proof of a leak?

It can. The ICO explains that loss of availability of personal data due to ransomware may constitute a personal data breach. Assess the facts, likely risk and legal obligations.

Will paying the ransom make my network safe?

No. NCSC and law enforcement do not encourage payment and warn there is no guarantee of decryption, removal of malware or non-publication of stolen data.

Can I simply restore my latest backup?

Only after verifying the backup and destination systems are clean and the original compromise has been addressed. Otherwise you may restore malware or reconnect the attacker.

Does reporting to NCSC also report the breach to the ICO?

No. NCSC’s reporting service explicitly warns that it does not fulfil separate legal or regulatory notification requirements.

The recovery sequence to remember

Isolate the infected systems. Protect clean backups and evidence. Contact incident responders. Report the live crime. Assess ICO and other notification duties. Do not trust the ransom demand. Restore from verified clean systems and monitor for reinfection.

Related practical guide: What to Do When Your Identity Is Stolen in the United States.

A simple incident command meeting for the first working day

A ransomware incident creates competing pressures: customers need orders, staff want payroll, managers seek files, the insurer asks for evidence and the IT team needs to isolate systems. Treat these as separate decisions. Ask the responder whether malicious activity remains, which accounts are trustworthy and which backups have been checked. Ask the business owner which operations are essential and which must stop to avoid wrong payments or unsafe services. Assign one person to keep a decision log with responsible owners and the time of each action. This helps avoid contradictory instructions while containment continues.

Before restoring a service, decide who can approve it. IT should confirm the relevant device, identity system and data sources have been assessed; operational management should confirm that transactions can be handled accurately; and the relevant data protection lead should evaluate notification duties. A staged restart may begin with the safest essential functions rather than all computers at once. The goal is a documented risk-based recovery, not a promise that everything will be running by an arbitrary time. Staff should have a clear channel for asking whether a particular application is approved for use.

Suppliers, contractors and cloud accounts

An organisation’s systems may extend beyond its own office. Web agencies, payroll providers, cloud services and outsourced IT companies might hold privileged credentials, backups or customer information. Contact the relevant partners through verified channels and ask them to protect linked accounts and preserve evidence. Do not send administrator credentials through a compromised corporate mailbox or authorise every contractor to connect to the network. Make a record of who controls each service so that no one assumes another organisation has already disabled an unsafe integration.

Where a contracted data processor has suffered a breach, the ICO explains that it must inform the controller without undue delay once aware. A controller must then assess its own obligations, including the likelihood of harm to individuals and any 72-hour notification deadline. Do not assume a provider’s statement that no files were visibly published is the end of the assessment. Loss of availability, altered records and the possibility of exfiltration may all require consideration. Keep the written contract and the actual facts available to the people making these decisions.

Customers, cyber insurance and the second wave of fraud

Attackers may impersonate an organisation’s help desk or bank while a ransomware recovery is in progress. Tell employees to verify unusual calls and payment changes through previously known channels. If customers must be warned, issue a carefully checked notice from an account or website you know is under legitimate control. Do not ask customers to send identification or payment information through an unverified temporary link. Communicate known facts and practical protective steps, while clearly identifying matters still being investigated.

If cyber insurance exists, contact the verified claims service promptly and ask whether the policy has designated responders, notification periods or evidence requirements. The policy does not override immediate containment or statutory duties, and coverage for losses or ransom is not automatic. Keep invoices, incident logs and receipts securely. A recovery review should identify the weakness that allowed access, including unused accounts, remote access, shared passwords or unsafe backups. Long-term improvement means tested restoration, protected backups, restricted administrative permissions, useful monitoring and a practised response plan.

Official UK sources

Independent UK small-business incident-response guide. Reviewed 6 November 2026 using NCSC, ICO and police reporting sources. Cyber incidents and legal obligations vary; seek qualified IT, legal and data-protection advice and use current official reporting channels.

What to Do When Ransomware Locks Your Business in the United Kingdom | Quick Actionable Ideas and Survival Tips