Most breaches don't announce themselves with a ransom note. They start with small oddities: a login alert from a country you've never visited, an email rule you didn't create, a colleague whose account is suddenly sending invoices. Spotting those signs early, and knowing what to do next, is what keeps a bad day from becoming a bad year.
This guide covers the warning signs worth acting on, a simple first-response sequence, and the UK reporting rules that start ticking as soon as you realise personal data may be involved.
How common are breaches?
The UK government's Cyber Security Breaches Survey 2025/2026, published in April 2026, found that 43% of businesses and 28% of charities reported a breach or attack in the previous 12 months. Phishing was by far the most common type, experienced by 38% of businesses. The survey's authors point out that it only counts incidents organisations identified and were willing to report, so the real figure may be higher.
The same survey found that only 25% of businesses had a formal incident response plan. That gap matters, because the hours after you notice something odd are when good decisions are hardest to make.
Warning signs on accounts
Email and cloud accounts are usually the first thing attackers go after, because one inbox can unlock password resets for everything else. Watch for:
- Sign-in alerts you don't recognise, especially from new locations, devices or browsers.
- Password reset or multi-factor prompts you didn't request. Repeated prompts can mean someone already has the password and is trying to wear you down into approving a login.
- New mailbox rules that forward, delete or hide messages, often ones containing words like "invoice", "payment" or "bank".
- Sent items you didn't write, or contacts replying to messages you never sent.
- New admin accounts, app passwords or third-party app connections in your Microsoft 365 or Google Workspace admin console.
Warning signs on devices and networks
- Security software turned off or showing errors you can't explain.
- Unfamiliar programs, browser extensions or scheduled tasks. Remote-access tools that nobody remembers installing are a particular red flag.
- Unusual outbound traffic, such as large uploads at night or connections to cloud storage services you don't use.
- Files that won't open or have new extensions, which can be the early stages of ransomware encryption.
- Logs that have been cleared or gaps in log history. Attackers delete evidence when they can.
The NCSC's 10 Steps to Cyber Security lists logging and monitoring as one of its core steps for exactly this reason: you can't spot anomalies in data you never collected. For a small organisation that might simply mean turning on the audit logs that your email and cloud providers already offer, and checking who receives the alerts.
Warning signs in people and processes
Not every sign is technical. Be alert to:
- A supplier "changing bank details" by email, especially with urgency attached.
- Customers telling you they received odd messages that appear to come from you.
- Staff mentioning that they entered a password on a page that "looked a bit off", or approved a login prompt they weren't expecting.
Make it easy and blame-free for people to report these. A five-minute report from someone who clicked a link is far more useful than silence.
Why speed matters
IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at USD 4.99 million, a 12% increase on the previous year and a record high. Most of the organisations in that study are far larger than a typical UK small business, so treat the headline figure as a sign of direction rather than a forecast for your own costs. The practical point holds at any size: the longer an attacker sits inside your systems, the more data they can take and the more expensive the clean-up becomes.
The first hour: contain
- Disconnect affected devices from the network (unplug the cable, turn off Wi-Fi). Avoid wiping or rebuilding them yet, as that can destroy evidence.
- Reset passwords for affected accounts from a device you trust, and sign out all active sessions.
- Remove anything the attacker added: mailbox rules, forwarding addresses, app connections and new admin accounts.
- Turn on multi-factor authentication where it is missing.
- Call your bank immediately if any payment details were changed or money moved.
The first day: log and assess
Start a written log straight away: what you noticed, when, who was involved, and every action taken. The ICO's guidance for small organisations, 72 hours: how to respond to a personal data breach, recommends starting a log even if you end up not needing to report.
Then work out what was exposed. Was it personal data about customers or staff? Financial details? Health information? The answer decides your legal obligations.
The 72-hour reporting rule
Under UK GDPR, a personal data breach that is likely to pose a risk to people must be reported to the ICO without undue delay and within 72 hours. The ICO stresses that the clock starts when you discover the breach, not when it happened. You don't need every detail to report: you can submit what you know and follow up later. If you're unsure whether a breach is reportable, the ICO offers a self-assessment tool and a personal data breach advice line on 0303 123 1113.
If the risk to individuals is high, you will usually need to tell the affected people too, in plain language, with practical steps they can take, such as changing passwords and watching for phishing.
After the incident
- Find the root cause. A reused password, an unpatched server and a convincing phishing email need very different fixes.
- Patch and harden the weakness that let the attacker in.
- Review who gets alerts and whether anyone actually reads them.
- Write down what you'd do differently and turn it into a one-page incident plan for next time.
A quick checklist
- Audit logging is switched on for email, cloud storage and admin consoles.
- Sign-in alerts go to someone who will act on them.
- Multi-factor authentication is on for every account that supports it.
- Staff know how to report a suspicious message or a mistaken click.
- You have contact details for your IT provider, bank and insurer somewhere other than the systems that might be down.
- You know whether you hold personal data, and who decides whether to report to the ICO.
Frequently asked questions
What is the most common type of cyber attack on UK businesses?
Phishing. The government's Cyber Security Breaches Survey 2025/2026 found phishing was by far the most prevalent type of breach or attack, experienced by 38% of businesses. Source: GOV.UK: Cyber security breaches survey 2025/2026.
Do I have to report every breach to the ICO?
No. You must report a personal data breach if it is likely to pose a risk to people's rights and freedoms, within 72 hours of becoming aware of it. You should record every breach, whether or not you report it. Source: ICO: 72 hours, how to respond to a personal data breach.
Should I switch an infected computer off?
Disconnecting it from the network (unplug the cable, turn off Wi-Fi) is usually the first step. Pulling the power can destroy evidence that helps an investigation, so if you have an IT provider or insurer, ask them before wiping or rebuilding anything.
Sources and further reading
- GOV.UK: Cyber security breaches survey 2025/2026
- IBM: Cost of a Data Breach Report 2026
- ICO: 72 hours, how to respond to a personal data breach
- NCSC: 10 Steps to Cyber Security
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.