A practical, step-by-step guide from your IT support team
If your small business suffers a cyber attack, contact your IT support provider immediately, isolate affected devices, secure compromised accounts and preserve evidence. Identify which systems and data have been affected, notify the appropriate organisations and restore systems only when it is safe to do so. Acting quickly can help limit the damage, protect business data and reduce disruption.
It usually starts with something small. A member of staff can’t open a file. A strange message demands payment in Bitcoin. A supplier calls to say they’ve received an odd invoice from your email address. Within minutes, it becomes clear that your business has been hit by a cyber attack.
If that happens to you, try to stay calm. Small businesses are frequently targeted, partly because attackers may assume they have fewer defences than larger organisations. What matters now is how quickly and carefully you respond.
The first few hours can make the difference between a manageable incident and a business-threatening disaster.
Here is what we recommend:
1. What should you do first after a cyber attack?
Fear leads to rushed decisions, like deleting files, rebooting everything or paying a ransom on impulse.
Instead, nominate one person to lead the response and make sure everyone knows who it is. If you have an IT support provider, call them straight away.
The sooner experienced people are involved, the more options you will have.
If you suspect an attack is still taking place, avoid using potentially compromised accounts or devices to communicate sensitive information. Your IT support team can advise on the safest way to coordinate the response.
2. How do you stop a cyber attack from spreading?
Your first technical goal is to contain the attack and prevent further damage.
- Disconnect affected devices from the network. Unplug the network cable or turn off Wi-Fi. Don’t switch devices off unless advised to do so, as this can destroy evidence that may help investigators.
- Protect your backups. Isolate any backup drives or connections that could be affected, following your IT provider’s advice, so the attacker cannot encrypt or delete backup data.
- Secure compromised accounts. Change passwords for affected accounts, including email, banking and administrator accounts, using a device you know is clean. Your IT provider may also need to revoke active sessions and disable compromised access.
- Enable multi-factor authentication (MFA). Make sure affected accounts are secured and introduce MFA wherever it is not already in place.
The appropriate action will depend on the type of attack. For example, a compromised email account may require a different response from a ransomware infection affecting several computers.
Your IT support provider should help you establish what needs isolating and how to prevent the attacker from maintaining access.
3. How can you find out what happened during a cyber attack?.
You can’t fix what you don’t understand.
Try to establish:
- What type of attack is it? Ransomware, phishing, a compromised email account or data theft?
- Which systems, accounts and data are affected?
- When did it start, and how did the attacker get in?
- Is the attack still ongoing?
- Could customers, suppliers or employees also be affected?
Keep notes as you go. Record times, screenshots, ransom messages and the names of anyone who spotted problems.
This log will be invaluable for your IT provider, your insurer and, if necessary, regulators.
Preserving evidence also makes it easier to investigate the cause of the attack and identify what needs to change before systems are restored.
4. Should a small business pay a ransomware demand?
If you are facing ransomware, the temptation to pay can be strong, particularly if important files have been encrypted and your business cannot operate normally.
But there is no guarantee you will get your data back. Payment may mark you as a willing target for future attacks, and it funds criminal activity.
The National Cyber Security Centre (NCSC) and UK law enforcement advise against paying ransomware demands.
Speak to your IT provider and, if you have one, your cyber insurer before making any decision.
A reliable backup and recovery strategy can make a significant difference in this situation, particularly if your business can restore essential systems without relying on the attacker.
5. Who should a small business notify after a cyber attack?
Depending on the nature of the attack, you may have legal, regulatory and contractual duties to report it.
Your cyber insurer
Many policies require prompt notification and may provide access to incident response specialists. Check your policy as soon as possible rather than waiting until the full extent of the attack is known.
Your bank
If financial details or payments are involved, alert your bank immediately so it can try to stop fraudulent transactions or secure affected accounts.
The Information Commissioner’s Office (ICO)
If personal data has been lost, stolen, exposed or otherwise compromised, you need to assess whether the incident is a reportable personal data breach.
Under UK GDPR, breaches that are likely to result in a risk to individuals’ rights and freedoms generally need to be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Not every cyber attack is reportable, but the assessment and the reasons for your decision should be documented. Some incidents may also require you to notify affected individuals.
The police and national cyber crime reporting services
Cyber crime can be reported through the relevant national police reporting service. Incidents can also be reported to the NCSC, which provides guidance for organisations responding to cyber attacks.
Customers, suppliers and staff
If their data or security could be affected, honest and timely communication helps protect them and maintain trust.
Your IT provider, insurer and any legal advisers involved can help you determine what information needs to be shared and when.
For example, restoring access to business-critical files, email or essential applications may take priority over less urgent systems.
Recovery should also include checking that affected devices and accounts are secure before employees resume normal work.
7. How can you prevent another cyber attack?
After the immediate crisis, don’t skip the investigation into what went wrong.
Ask:
- How did the attacker get in? Was it a phishing email, a weak password, unpatched software or an exposed remote access port?
- Why wasn’t the attack caught sooner?
- What needs to change to prevent the same type of attack happening again?
Then act on the answers.
That might mean patching systems, tightening access controls, introducing staff awareness training or upgrading your email security.
It may also mean reviewing how your business manages Microsoft 365 accounts, backups, devices and security monitoring.
The aim is to address the weaknesses that allowed the attack to happen, rather than simply getting everything working again and moving on.
How can a small business prepare for a cyber attack?
The best time to prepare for a cyber attack is before one occurs. A few straightforward steps can make a significant difference.
- Back up regularly. Keep a copy offline or separate from your network, and test that you can restore from it.
- Use multi-factor authentication. Enable MFA wherever possible, particularly for email, administrator accounts and business-critical applications.
- Keep software and devices updated. Many attacks exploit known security flaws for which fixes are already available.
- Train your team. Phishing and other social engineering attacks often rely on somebody being persuaded to click a link, open an attachment or share information. Regular, practical awareness training is one of the most cost-effective defences available.
- Write a simple incident response plan. Include who to call, who is in charge and where key contact details and policy numbers are stored offline.
- Consider cyber insurance. Understand what your policy covers, what it excludes and what you need to do if an incident occurs.
- Work with a trusted IT support partner. A provider who monitors your systems and can respond quickly when something goes wrong can help reduce the impact of an attack..
These measures are particularly important for small businesses that do not have their own dedicated IT or cyber security team.
How can managed IT support help protect a small business from cyber attacks?
For many small businesses, keeping on top of security updates, monitoring, backups and user access can be difficult alongside everyday operations.
Managed IT support can help by making these activities part of an ongoing process.
Depending on the services in place, this may include monitoring devices, managing software updates, maintaining security tools, reviewing Microsoft 365 access and checking that backups are operating correctly.
It also means having somebody to contact when something suspicious happens, rather than trying to work out the next steps during an emergency.
At Adept IT Solutions, we support businesses across Norwich and Norfolk with practical IT support and cyber security advice, helping them reduce risks and respond when problems arise.
Get your business ready before an attack happens
No business can eliminate cyber risk completely, but every business can reduce it and prepare for the worst. A swift, structured response limits the damage, protects your customers and helps you get back to work faster.
If you would like to know how well prepared your business is, Adept IT Solutions offers a free cyber security health check.
We will review your backups, your defences and your response plan, and show you where the gaps are before an attacker finds them.
Get in touch with our team today. And if you are dealing with an attack right now, call us immediately. We are here to help.
Frequently asked questions
What is the first thing a small business should do after a cyber attack?
Contact your IT support provider and begin containing the incident. This may involve disconnecting affected devices, securing compromised accounts and preserving evidence. Avoid deleting files or restarting affected computers without advice, as this could interfere with an investigation.
Does a small business have to report a cyber attack to the ICO?
Not every cyber attack needs to be reported to the ICO. If the incident involves a personal data breach that is likely to result in a risk to individuals’ rights and freedoms, it will generally need to be reported within 72 hours of becoming aware of the breach, where feasible. Businesses should assess and document the incident and seek appropriate advice?
Can a small business recover from ransomware without paying?
Potentially, yes. If the business has clean, reliable backups and the attack has been contained, it may be possible to restore affected systems and data without paying a ransom. The outcome depends on the nature of the attack, the available backups and whether the attacker still has access.
How long does it take a small business to recover from a cyber attack?
Recovery time depends on the severity of the incident, how many systems are affected, whether data has been compromised and the quality of the business’s backups and recovery plan. Some incidents can be resolved relatively quickly, while more serious attacks can cause disruption lasting days or longer.
Can managed IT support help prevent cyber attacks?
Managed IT support can help reduce cyber security risks through regular updates, device monitoring, security management, backups and user access controls. No provider can guarantee that an attack will never happen, but proactive support can help businesses prepare and respond more effectively.
