After a cyber attack: what to report, and to whom

Personal data locked by ransomware is a personal data breach under UK law, even if nothing was copied. If you must report but do not have the full facts yet, report what you know and send the rest in stages. A report to the National Cyber Security Centre (NCSC) does not reach the UK data protection regulator.

Incident response has its own accreditation. The NCSC assures incident response firms, and recommends that UK organisations use one. CREST, which accredits security firms, lists its members by service.

What to do after a cyber attack: the first steps

1. Start at GOV.UK's reporting service, which the NCSC recommends, to find where to report the attack.
2. Decide whether personal data was affected, and if so, whether the risk to people means you must report it.
3. If you bring in a response firm, check its accreditation on the NCSC list or the CREST Marketplace. Check that it covers incident response, not only testing.
4. Agree who reports to the UK data protection regulator and who does the technical work. They are different jobs, and often different firms.
5. Record every personal data breach, even one you decide not to report.

Cyber attacks and ransomware: common questions

Do we need a lawyer as well as a technical firm?

You may need a lawyer as well as a technical firm, depending on the attack. After a serious incident, the legal advice and the technical work often run side by side. If you use both, agree early how they will work together, and who briefs whom.

Does ISO 27001 show a firm can respond to an attack?

ISO 27001 alone does not show that a firm can respond to an attack. ISO 27001 is a standard for information security management, and organisations are certified against it. Cyber Essentials is the minimum standard of cyber security the UK government recommends for organisations of all sizes. Both describe how a firm protects itself, not how it responds to an attack on a client.

Will paying the ransom fix the breach?

No. The ICO's guidance does not treat paying a ransom as an appropriate way to restore personal data. The guidance backs law enforcement in not encouraging payment, and recommends that you contact law enforcement.

Should we pay for a retainer before anything happens?

Whether to pay for a retainer depends on what a day of downtime would cost you. If you look at one, read the response-time clause first. Ask whether the fee counts against the hours you use, and what priority it buys.