How to Protect Your Business from Cyber Crime: A Practical UK Guide

Cyber crime remains a genuine, ongoing risk for UK businesses of every size, not just the large, headline-grabbing organisations. Protecting a business properly means two things: putting sensible prevention in place, and knowing exactly what to do if something still gets through. Most guidance focuses heavily on the first and barely touches the second, which is a gap worth closing.

Prevention in brief

The fundamentals, antivirus protection, staff awareness, strong passwords and multi-factor authentication, firewalls, and regular backups, remain the foundation of good defence. We’ve covered these in detail in our cyber security checklist for UK businesses, so rather than repeat that here, this guide focuses on the part that’s talked about far less: what to actually do if prevention isn’t enough.

Recognising When Something’s Wrong

Some incidents are obvious, a ransomware message locking you out of your files, a clearly fraudulent payment request. Others are quieter: unusually slow systems, files that have moved or changed without explanation, staff reporting emails they don’t remember sending, or a client mentioning a strange email that appeared to come from your business. Any of these are worth investigating immediately rather than waiting to see if it resolves itself.

Immediate Steps If You Suspect an Incident

• Isolate affected systems: disconnect the affected device from the network, but avoid switching it off entirely if possible, doing so can destroy evidence needed for investigation.
• Don’t panic-wipe or reinstall: as tempting as it is to simply clean everything and move on, doing so before an investigation can destroy the evidence needed to understand what happened and whether data was actually accessed.
• Change compromised credentials immediately: particularly for any account that may have been involved, and enable multi-factor authentication anywhere it isn’t already active.
• Contact your IT support provider straight away: they should be your first call, not your last resort, for containing the incident and beginning a proper investigation.

Who to Report It to, and When

Reporting can feel like an afterthought in the middle of an incident, but it matters, both legally and practically.

• Action Fraud: the UK’s national reporting centre for fraud and cyber crime (England, Wales, and Northern Ireland). If an attack is actively in progress, call 0300 123 2040, available 24 hours a day. For anything that isn’t actively ongoing, report online at actionfraud.police.uk. Businesses in Scotland should report to Police Scotland on 101 instead.
• The National Cyber Security Centre (NCSC): worth reporting to directly at ncsc.gov.uk/report for significant incidents, particularly anything involving critical infrastructure, a large volume of personal data, or essential services.
• The ICO: if personal data has been compromised and the breach poses a risk to individuals’ rights and freedoms, you’re legally required to report it to the Information Commissioner’s Office within 72 hours of becoming aware, covered in more detail in our guide to UK GDPR.
• Suspicious emails: forward these to the NCSC’s Suspicious Email Reporting Service at report@phishing.gov.uk, whether or not they’ve led to an actual incident.

Cyber Insurance

If your business holds cyber insurance, contact your provider early, often within the first 24 hours, since many policies require prompt notification and may specify particular forensic or legal partners you’re required to use. Even without a specific policy, it’s worth checking whether general business insurance offers any relevant cover, and considering dedicated cyber insurance if it doesn’t.

Communicating With Clients and Stakeholders

If client or customer data may have been affected, and the risk to them is high, you’re expected to notify affected individuals, generally within a week of the breach being identified. Clear, honest communication protects both the people affected and your business’s reputation far more than silence or delay ever does.

After the Immediate Response: Learning From It

Once systems are restored, ideally from clean, verified backups, a proper post-incident review is worth the time it takes. What let the incident happen, what worked well in the response, and what would make next time faster and less damaging. Having an incident response plan already written, before you ever need it, is what turns this section from theory into something your business can actually follow under pressure.