# After a cyber attack: what to report, and to whom An attack can be a security incident and a data breach at once, and each has its own reporting route. **The short answer.** Two jobs run side by side: dealing with the attack, and deciding whether it is a personal data breach. If people are likely to be at risk, UK law says you must report the breach to the UK data protection regulator. Do this without undue delay and, where feasible, within 72 hours of becoming aware of it (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026). Personal data locked by ransomware is a personal data breach under UK law, even if nothing was copied. If you must report but do not have the full facts yet, report what you know and send the rest in stages. A report to the National Cyber Security Centre (NCSC) does not reach the UK data protection regulator (the [ICO on ransomware](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), the [ICO's breach guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/) and [GOV.UK](https://www.gov.uk/report-cyber), checked 29 September 2026). Incident response has its own accreditation. The NCSC assures incident response firms, and recommends that UK organisations use one. CREST, which accredits security firms, lists its members by service (the [NCSC](https://www.ncsc.gov.uk/schemes/cyber-incident-response/information-for-buyers) and the [CREST Marketplace](https://marketplace.crest.org/), checked 29 September 2026). **Who to tell after an attack** - **The NCSC's reporting service**: Tells you where to report the attack itself (on GOV.UK at gov.uk/report-cyber) - **The UK data protection regulator**: Takes reports of personal data breaches likely to put people at risk (the [Information Commission](/news/ico-becomes-the-information-commission) (the ICO), its name since 30 September 2026) - **The people affected**: Must be told directly when the risk to them is high (customers or staff whose data was involved) - **Law enforcement**: The ICO's guidance recommends contacting them after a ransomware attack (the police) Each report goes to a different place, so one attack can mean more than one report. Source: GOV.UK, where to report a cyber incident, https://www.gov.uk/report-cyber (checked 29 September 2026); ICO, personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 29 September 2026); ICO, ransomware and data protection, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/ (checked 29 September 2026); S.I. 2026/1015, https://www.legislation.gov.uk/uksi/2026/1015/made (checked 2 October 2026); The ICO: ICO welcomes transition to new Information Commission, 30 September 2026, https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/ (checked 2 October 2026) > "Information you give will not be shared with the Information Commissioner’s Office (ICO)" > National Cyber Security Centre, on GOV.UK, https://www.gov.uk/report-cyber (checked 29 September 2026) ## What to do after a cyber attack: the first steps 1. Start at [GOV.UK's reporting service](https://www.gov.uk/report-cyber), which the NCSC recommends, to find where to report the attack. 2. Decide whether personal data was affected, and if so, whether the risk to people means you must report it. 3. If you bring in a response firm, check its accreditation on the [NCSC list](https://www.ncsc.gov.uk/schemes/cyber-incident-response/find-a-provider) or the [CREST Marketplace](https://marketplace.crest.org/). Check that it covers incident response, not only testing. 4. Agree who reports to the UK data protection regulator and who does the technical work. They are different jobs, and often different firms. 5. Record every personal data breach, even one you decide not to report (the [ICO](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 29 September 2026). ## The 11 providers for this situation Grouped by type, alphabetical inside each type. ### Advisory firms (11) - [Accorian (Esha Corporation dba Accorian; Accorian Assurance)](https://theassurancedesk.com/advisers/accorian.md): Advisory firm - [Arcanum Cyber Security (Arcanum Information Security Limited)](https://theassurancedesk.com/advisers/arcanum-cyber-security.md): Advisory firm - [Bridewell](https://theassurancedesk.com/advisers/bridewell.md): Advisory firm - [Cyber Defense Group](https://theassurancedesk.com/advisers/cyber-defense-group.md): Advisory firm - [Evalian](https://theassurancedesk.com/advisers/evalian.md): Advisory firm - [IT Governance (now GRC Solutions)](https://theassurancedesk.com/advisers/it-governance.md): Advisory firm - [Mishcon de Reya LLP](https://theassurancedesk.com/advisers/mishcon-de-reya-llp.md): Advisory firm - [RightCue Consulting Services Ltd](https://theassurancedesk.com/advisers/rightcue.md): Advisory firm - [RPC (Reynolds Porter Chamberlain LLP)](https://theassurancedesk.com/advisers/rpc-reynolds-porter-chamberlain.md): Advisory firm - [Samurai Digital Security Limited](https://theassurancedesk.com/advisers/samurai-digital-security-limited.md): Advisory firm - [URM Consulting](https://theassurancedesk.com/advisers/urm-consulting.md): Advisory firm ## Cyber attacks and ransomware: common questions ### Do we need a lawyer as well as a technical firm? You may need a lawyer as well as a technical firm, depending on the attack. After a serious incident, the legal advice and the technical work often run side by side. If you use both, agree early how they will work together, and who briefs whom. ### Does ISO 27001 show a firm can respond to an attack? ISO 27001 alone does not show that a firm can respond to an attack. ISO 27001 is a standard for information security management, and organisations are certified against it. Cyber Essentials is the minimum standard of cyber security the UK government recommends for organisations of all sizes. Both describe how a firm protects itself, not how it responds to an attack on a client ([UKAS](https://www.ukas.com/accreditation/sectors/digital/info-sec/) and [the NCSC](https://www.ncsc.gov.uk/cyberessentials/overview), checked 29 September 2026). ### Will paying the ransom fix the breach? No. The ICO's guidance does not treat paying a ransom as an appropriate way to restore personal data. The guidance backs law enforcement in not encouraging payment, and recommends that you contact law enforcement (the [ICO](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 29 September 2026). ### Should we pay for a retainer before anything happens? Whether to pay for a retainer depends on what a day of downtime would cost you. If you look at one, read the response-time clause first. Ask whether the fee counts against the hours you use, and what priority it buys. ## Where next - [After a data breach: what UK law asks of you](https://theassurancedesk.com/best/post-breach.md) - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.