Guide summary

If you suspect a ransomware attack, disconnect affected computers from the network immediately. Then report the incident to Report Fraud (0300 123 2040) and the ICO within 72 hours if personal data is involved. Do not pay the ransom.

Disconnect affected computers from the network straight away
Isolate backup systems to stop ransomware destroying them
Do NOT turn computers off — this preserves evidence
Report to Report Fraud on 0300 123 2040 (24/7 during live attack)
Tell staff to stop using all computers until given the all-clear
Report personal data breaches to the ICO within 72 hours
Check for free decryption tools at nomoreransom.org
Contact NCSC immediately if you need urgent help

Ransomware encrypts your files and demands payment for their return. It is the most acute cyber threat facing UK businesses - the NCSC responds to 35-40 incidents per week, with 71% targeting small businesses.

Speed matters. The first hours determine whether you can recover your business.

NCSC cyber threat statistics 2025

Current statistics on cyber attacks targeting UK organisations from NCSC Annual Review 2025.

The UK is experiencing record cyber threats. The National Cyber Security Centre (NCSC) states: "The question is no longer if your organisation will face a cyber incident, but when."

NCSC CEO Richard Horne's warning: "Cyber criminals will target organisations of all sizes, operating in any sector."

Nationally significant attacks (year to September 2025): 204 attacks (up from 89 previous year)
Nationally significant attacks per week: 4 per week
Increase in highly significant incidents: 50% increase
Proportion of attacks classified as nationally significant: 48% (record high)
Ransomware incidents per week: 35-40 incidents per week (up from 20-25 in 2024)
Ransomware classification: Most acute cyber threat to UK organisations (NCSC)
Small businesses targeted by ransomware: 71% of ransomware attacks
Average ransomware downtime: 21 days
Average ransom demand: £100,000-£500,000 (varies widely)
Suspicious emails reported to SERS: 10.9 million in past year
Successful attacks beginning with phishing: Over 90%
People using easy-to-guess credentials: 19%
Businesses reviewing supplier cyber risk: Only 14% in last 12 months

1. Contain the attack immediately

Stop ransomware spreading to more systems. Every minute of delay means more encrypted files.

Disconnect affected computers from the network

Unplug ethernet cables and disable Wi-Fi on systems showing ransomware signs (ransom message, encrypted files, unusual file extensions). Do NOT turn computers off - this preserves evidence.
Disconnect shared drives and cloud storage

Network drives, NAS devices, and cloud sync services (OneDrive, Dropbox) are prime targets. Disconnect them immediately.
Isolate backup systems

Disconnect backup storage from the network immediately. Many ransomware variants target backups to prevent recovery.
Alert IT support and warn staff

Contact IT immediately. Tell all staff to stop using computers until given the all-clear.

2. Assess and report

Identify what is affected and report to the relevant authorities.

Document affected systems

Check each computer and server for ransom notes, files with unusual extensions (.locked, .encrypted), or files that will not open.
Check whether backups are intact

Test backups using a clean computer - do NOT connect backup drives to potentially infected systems.
Identify the ransomware variant

The ransom note often identifies the strain. Check nomoreransom.org for free decryption tools.
Preserve evidence

Photograph ransom messages. Keep logs of what happened and when. Do not delete files.

Cyber incident reporting contacts and procedures

Who to report cyber incidents to, including Action Fraud, ICO, NCSC, and geographic variations for Scotland.

Different cyber incidents require reporting to different authorities. All UK organisations should know their reporting obligations and have key contacts readily available.

Cyber crime reporting (England, Wales, NI): Report Fraud (formerly Action Fraud) - reportfraud.police.uk or 0300 123 2040
Cyber crime reporting (Scotland): Police Scotland via 101 (Scotland has not signed up to Report Fraud process)
Report Fraud phone hours: Monday-Friday 8am-8pm (24/7 for organisations under live attack)
Report Fraud from abroad: +44 300 123 2040
Data breach reporting (all UK): ICO at ico.org.uk/for-organisations/report-a-breach (within 72 hours if risk to individuals)
ICO helpline: 0303 123 1113 (Monday-Friday 9am-5pm)
Phishing email reporting: NCSC Suspicious Email Reporting Service (SERS) - forward to report@phishing.gov.uk
NCSC Cyber Incident Response (CIR) Scheme: Industry assurance scheme - all UK organisations should use CIR Assured Service Provider when dealing with cyber incidents
NHS organisations (NIS OES in England): Report to NHS England within 72 hours for incidents with adverse effect on security or significant impact on service continuity
Financial services firms: Report to FCA/PRA as per firm's notification procedures
Operators of Essential Services: Report to sector regulator within 72 hours
Digital service providers: Report to ICO within 72 hours if substantial impact
Under active cyber attack (need help): NCSC at ncsc.gov.uk and CIR provider immediately
What Report Fraud cannot do: Not investigative body, cannot guarantee police investigation or advise on report contents
Why report even if not investigated: Builds intelligence picture, identifies patterns, informs national policing priorities

Report data breaches to the ICO

Ransomware encrypting personal data is a breach under UK GDPR. You may need to notify the ICO within 72 hours.

ICO data breach notification requirements (72-hour rule)

Two-tier notification requirements under UK GDPR, including the 72-hour rule for reporting to ICO and requirements for notifying affected individuals.

Under UK GDPR, organisations must report personal data breaches to the Information Commissioner's Office (ICO) within 72 hours if the breach is likely to result in a risk to individuals' rights and freedoms. A two-tier system applies:

Risk to individuals: Report to ICO within 72 hours
High risk to individuals: Report to ICO within 72 hours AND notify affected individuals without undue delay

The clock starts when you become aware of the breach, not when it originally happened or when you complete full investigation.

ICO reporting timeline: Within 72 hours of becoming aware of the breach
Threshold for ICO reporting: Breach likely to result in risk to rights and freedoms of individuals
Threshold for individual notification: Breach likely to result in high risk to rights and freedoms of individuals
Individual notification timeline: Without undue delay
When clock starts: When you become aware of the breach (sufficient evidence to believe incident occurred and meets threshold)
How to count 72 hours: Count hours, not working days (weekends and bank holidays count)
If you miss 72 hours: Still must report, must provide reasons for delay
Phased reporting permitted: Yes - initial report within 72 hours with available information, updates without undue delay
ICO reporting method: Online tool at ico.org.uk/for-organisations/report-a-breach
Exceptions to individual notification: Data encrypted/unintelligible, measures taken to eliminate high risk, or disproportionate effort (use public communication instead)
Record keeping requirement: Document all breaches whether or not reported to ICO (UK GDPR Article 33(5))
Recommended record retention: At least 3 years (aligns with ICO investigation timeframes)

3. Recovery options

In order of preference:

Option A: Restore from backups (preferred)

Verify backups are clean before restoring
Rebuild systems from scratch - ransomware may have left backdoors
Patch systems before reconnecting to the network

Option B: Use a free decryption tool

Check nomoreransom.org - a legitimate project providing free tools for many ransomware families
Do not pay for tools from unknown sources - many are scams

Option C: Rebuild without data recovery

Wipe systems and reinstall. Rebuild data from paper records and other sources
Painful but sometimes faster than waiting for decryption

4. The ransom payment decision

The NCSC and law enforcement strongly advise against paying. Understand the risks:

No guarantee of recovery: Criminals may not provide working keys or may demand more
Funds crime: Payment finances future attacks
Makes you a target: Paying organisations are often attacked again
May be illegal: Paying groups on UK sanctions lists is a criminal offence
Data may still be sold: Attackers often copy data before encrypting

Sanctions risk

Many ransomware groups are linked to sanctioned entities. Before any payment, check the UK sanctions list and seek legal advice.

5. Recovery and prevention

After the crisis, focus on safe recovery and preventing recurrence.

Rebuild properly

Ensure systems are clean. Change all passwords. Enable multi-factor authentication. Apply all security updates before reconnecting.
Monitor for reinfection

Watch for unusual activity. Attackers may have established persistent access.
Conduct post-incident review

How did they get in? What failed? Document lessons and implement improvements.
Strengthen backups

Implement offline or immutable backups. Test restoration regularly.

6. Getting help

Consider professional support if you lack IT security expertise, the attack affects critical systems, or you need help with evidence preservation.

The NCSC maintains a list of Cyber Incident Response (CIR) Assured Service Providers - vetted companies for incident response. Your cyber insurance may also provide incident response services.

Before an attack happens

If reading this guide proactively:

Implement offline or immutable backups and test restoration
Enable multi-factor authentication for remote access and admin accounts
Keep systems patched - apply updates within 14 days
Train staff on phishing (90% of attacks start this way)
Create an incident response plan

Legal basis

Primary legislation and key regulations

Data Protection Act 2018 Primary 2018 · UK-wide Computer Misuse Act 1990 Primary 1990 · UK-wide Network and Information Systems Regulations 2018 SI 2018 · UK-wide UK GDPR (retained EU law) EU Retained 2016 · UK-wide

Browse UK legislation legislation.gov.uk

Official guidance

Where to report a cyber incident (opens in a new tab)

NCSC

Report a cyber incident to NCSC (opens in a new tab)

GOV.UK

Report a personal data breach to the ICO (opens in a new tab)

ICO

Report suspicious emails, texts and websites (opens in a new tab)

GOV.UK

Cyber security guidance for business (opens in a new tab)

GOV.UK

Cyber Essentials scheme overview (opens in a new tab)

Publication · GOV.UK

Police Scotland (opens in a new tab)

www.scotland.police.uk

FCA operational resilience guidance (opens in a new tab)

FCA

NHS Data Security and Protection Toolkit (opens in a new tab)

Respond to a ransomware attack

1. Contain the attack immediately

Disconnect affected computers from the network

Disconnect shared drives and cloud storage

Isolate backup systems

Alert IT support and warn staff

2. Assess and report

Document affected systems

Check whether backups are intact

Identify the ransomware variant

Preserve evidence

Report data breaches to the ICO

3. Recovery options

Option A: Restore from backups (preferred)

Option B: Use a free decryption tool

Option C: Rebuild without data recovery

4. The ransom payment decision

Sanctions risk

5. Recovery and prevention

Rebuild properly

Monitor for reinfection

Conduct post-incident review

Strengthen backups

6. Getting help

Before an attack happens

Legal basis

Official guidance

Related guides in Compliance & Legal

Cyber security requirements for UK businesses

Report a cyber incident

Cyber security basics for small businesses

Tech Sector Compliance Overview

NHS Data Security and Protection Toolkit compliance