A phishing email is clicked. A Microsoft 365, Google Workspace or accounting-system login suddenly looks unfamiliar. A supplier reports a strange invoice request apparently sent from your business. In a small company, the first reaction is often understandable: panic, followed by a rush to change everything, call everyone and send an all-staff warning.
That urgency can be useful, but unstructured urgency can also make an incident harder to investigate, disrupt legitimate work and create inconsistent messages for customers. The better goal is not to be emotionally detached. It is to be operationally calm: follow a short, role-based sequence that contains risk, captures facts and puts the right people in control.
This first-hour plan is designed for UK SMEs dealing with suspected phishing, mailbox takeover or account compromise. It is not a substitute for specialist incident-response, legal or data-protection advice. It is a practical playbook for buying your business time and avoiding the costly mistakes that pressure can produce.
The operating principle: slow the decision, not the response
“Stay calm” does not mean waiting for certainty. It means separating urgent actions from speculative actions. In the first hour, act quickly to stop further access, but do not guess at the attacker’s route, accuse a member of staff, wipe a device or make public promises before the facts support them.
Give one person the role of incident lead. For many small businesses, that will be the owner, operations director or outsourced IT lead. Their job is to coordinate, not personally solve every technical issue. They should keep one timestamped incident log, assign actions by name and set a rhythm: “What do we know? What have we done? What is the next safe action?”
The UK National Cyber Security Centre describes incident response as progressing through triage, containment, analysis, remediation and recovery. That sequence is useful because it prevents a common SME error: jumping straight to recovery before establishing what has happened. The NCSC also maintains a route to assured Cyber Incident Response providers for organisations that need expert help.
Before the clock starts: assign four roles
A rehearsed response is easier when each person knows their lane. One person may hold more than one role in a microbusiness, but the responsibilities should still be explicit.
- Incident lead: declares the incident, owns the action log, approves major decisions and keeps the business focused on verified facts.
- Technical lead: usually your MSP, IT manager or trusted external specialist. They contain access, preserve relevant logs and investigate systems.
- Business and customer lead: manages essential operations, supplier contact and carefully controlled communications.
- Data and finance lead: considers personal-data exposure, contracts, cyber insurance, payroll and payment risk. In a small firm this may be the owner, finance manager or external adviser.
Keep an offline version of this contact list. Include your MSP’s emergency number, cyber-insurance hotline, bank fraud contact, email and cloud-service administrators, solicitor or data-protection adviser, and the person authorised to speak externally. If the compromised account is the one holding the contact list, an online-only plan is not a plan.
Minutes 0–5: pause, declare and create one source of truth
1. Make a clear incident declaration
Use plain language: “We have a suspected account-compromise incident. [Name] is incident lead. Do not delete messages, reset systems or contact customers unless assigned.” This removes ambiguity without claiming more than you know.
Start an incident record immediately. Note the date and exact time the issue was discovered, who saw it, which account or device may be involved, the initial symptoms and each action taken. The Information Commissioner’s Office advises organisations to begin a log even while they are still establishing whether a personal data breach must be reported; the clock for a potential report starts when the organisation becomes aware of the breach, not when the intrusion occurred. See the ICO’s first-72-hours guidance for small organisations.
2. Use a 90-second fact check
Before anyone presses a destructive button, the incident lead asks four questions:
- What did we directly observe?
- What is only suspected?
- Which account, device, payment or customer group could be affected right now?
- What action reduces immediate harm with the least irreversible disruption?
For example, “An employee entered credentials into a fake page” is a fact if they confirm it. “The attacker copied every customer record” is not a fact yet. The first fact requires containment; the second requires investigation. Keeping that distinction visible stops frightening assumptions from becoming company “knowledge”.
3. Stop further engagement with the lure
Tell the affected employee not to reply to the suspicious message, enter further details or continue opening links and attachments. Ask them to write a short account of what they did: when the message arrived, what address or website was used, what information was entered and whether a download ran. Their recollection is most useful now, before details blur.
Minutes 5–15: contain access without destroying useful evidence
For a suspected stolen password or mailbox takeover
From a known-clean device, have the technical lead secure the affected account. The exact steps vary by provider, but the priority order is consistent:
- Reset the password to a strong, unique value.
- Revoke active sign-in sessions and refresh tokens where the service permits it.
- Review and correct multi-factor authentication methods, recovery email addresses and recovery phone numbers.
- Check for unfamiliar mailbox forwarding rules, inbox rules, delegated access, connected applications and OAuth permissions.
- Review recent sign-ins, security alerts and administrator changes.
- Reset or protect any accounts that reused the same password, starting with email, identity, banking, payroll, accounting and cloud administration.
Email is often the control centre for a small business. If an attacker controls a mailbox, they may be able to reset other services or impersonate the firm to suppliers and customers. Do not assume that a password reset alone has ended access; session tokens, forwarding rules and newly added authentication methods can matter too.
For a suspected malicious attachment, download or device compromise
If a file was opened, unexpected software ran, antivirus alerts appeared, files are changing or the device behaves abnormally, isolate that device from the network if you can do so safely. Disconnect Wi-Fi and unplug network cables; do not use the affected device for email, banking or password changes. Ask your technical lead before powering it off or wiping it, because logs and other evidence may help establish what happened.
Isolation may create a short service interruption, but the NCSC identifies isolating affected systems as a key response priority when active compromise is possible. The aim is containment, not punishment of the person who clicked. A blame-first response encourages staff to hide mistakes, which gives attackers more time.
Protect payments and supplier relationships
If the compromised mailbox belongs to someone involved in invoices, payroll or bank details, immediately introduce a temporary payment-control rule: no payment instruction or change of bank details is accepted from email alone. Verify requests through a known telephone number or a pre-existing trusted contact method, not a number supplied in the message.
Where a payment may already have been sent, contact your bank through its verified fraud channel at once. Record the payment reference, beneficiary details, amount, time and any related email. Speed matters, but so does a clean record of what was requested and authorised.
Minutes 15–25: preserve the evidence you will need later
Containment and evidence preservation are not opposing goals. You can revoke access while retaining the information needed to understand scope, notify insurers or make a report.
Create a restricted incident folder on a clean, access-controlled location. Save copies of suspicious emails, including full headers where your mail system allows it; screenshots of login alerts and suspicious rules; relevant URLs; file names and hashes if your IT provider can obtain them; user reports; and exports or screenshots of sign-in and audit logs. Record who collected each item and when.
Do not forward a live malicious link around the company “so everyone can see it”. Do not casually send customer data or sensitive screenshots over personal messaging apps. Do not edit original messages if a preserved copy can be made first. These small disciplines make it easier for a specialist to reconstruct events.
If it is simply a suspicious email and no interaction occurred, staff can report it to the NCSC by forwarding it to the government’s phishing-reporting service. The official GOV.UK phishing guidance gives the current reporting route. If credentials were entered or an account has been used, treat it as an incident first and report the suspicious message once evidence has been secured.
Minutes 25–40: establish scope and call the right support
Ask focused questions, not broad ones
At this stage, the incident lead should ask the technical lead for a short situation report. Keep it factual:
- Which account, device, application and data set are confirmed affected?
- When was the last known legitimate activity?
- Are there signs of external access, forwarding, data download, new admin users or messages sent from the account?
- Has the attacker reached other accounts or systems?
- What containment has already been applied, and what business impact has it created?
- What must happen in the next two hours?
For a one-person business without IT support, this is the point to call your MSP, cloud-service support channel or an incident-response provider. Give them the incident log and the facts, not a theory. If you have cyber insurance, contact the insurer or broker early and follow the policy’s conditions; insurers may require the use of particular legal, forensic or incident-response suppliers.
The NCSC directs organisations to GOV.UK’s cyber-incident reporting guidance to identify the appropriate reporting route. For fraud or financially motivated cybercrime in England, Wales and Northern Ireland, the current national route is Report Fraud. In Scotland, report suspected crime to Police Scotland. Reporting is not a substitute for containment, and containment should not wait for a report reference number.
Begin the personal-data assessment
Account compromise can become a personal data breach if it involves unauthorised access to, loss of or disclosure of personal information. The data and finance lead should begin a simple assessment: whose data may be involved; what categories of information are at risk; how many people may be affected; whether data was merely accessible or appears to have been exported; and what harm might realistically follow.
Under UK GDPR, organisations must keep a record of personal data breaches. If a breach is likely to risk people’s rights and freedoms, it must be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness. Where the risk is high, affected individuals must also be informed without undue delay. The ICO stresses that an organisation can report early and supply additional information later, rather than wait for a complete investigation. Use the ICO’s personal data breaches guide and obtain appropriate advice for your circumstances.
Minutes 40–50: communicate carefully, internally first
Silence can be unhelpful, but premature disclosure can confuse people, tip off an attacker or create commitments you cannot keep. The operationally calm approach is a narrow, need-to-know internal message.
A useful staff message might say: “We are investigating a suspected security incident involving [service]. Please do not reset passwords, delete messages, approve payment changes or contact customers about it unless asked. Send any unusual emails, login prompts or supplier requests to [named contact]. Continue using [approved alternative process].”
This tells people what to do without speculating about stolen data, naming a culprit or promising a recovery time. Ask frontline staff to use a single agreed response if customers call. For example: “We are investigating a technical issue and will update you through our usual verified channels when we have confirmed information.”
Do not issue a social-media statement in the first hour simply because the incident feels public. Do not promise that “no data was accessed” until logs and investigation support that conclusion. Do not contact every customer merely to demonstrate activity. The ICO’s guidance explains that notification to affected people depends on the assessed risk, and communication should give clear, specific advice where people need to take protective action.
Minutes 50–60: make the next two-hour plan
End the first hour with a short decision meeting. The incident lead should document the current status and allocate the next actions, owners and deadlines. A good handover answers five questions:
- Containment: Is attacker access believed blocked, and what remains exposed?
- Investigation: Which logs, devices, mailboxes and third parties still need review?
- Continuity: Which essential services need safe workarounds, and who approves them?
- Notification: Do we need to involve the insurer, bank, ICO, police, customers, suppliers or contractual partners now?
- Communications: Who may speak externally, what is the approved holding line and when will it be reviewed?
Set the next update time, even if it is only 30 minutes away. Regular, short updates lower panic because people know when decisions will be revisited. They also stop a senior owner being dragged into every conversation while technical work is under way.
What not to do in the first hour
Some actions feel decisive but can increase harm. Avoid these until your technical and business leads have assessed them:
- Wiping or factory-resetting a potentially compromised device before evidence is captured and support is consulted.
- Changing every company password from a possibly infected device.
- Assuming a single clicked link means the whole network is compromised, or assuming a reset password means the incident is over.
- Letting every manager email customers, suppliers or staff separately.
- Paying an invoice, changing bank details or releasing payroll because an email appears to come from a colleague.
- Deleting suspicious emails before preserving a copy and recording the relevant details.
- Blaming the employee who reported the problem.
That final point is more than a cultural nicety. Fast reporting is one of your best controls. Thank people for escalating suspicious activity quickly, then use the event to improve systems and training rather than create silence.
Turn the playbook into a business habit
A 60-minute plan works best when it is practised before a real incident. Once a quarter, run a 20-minute tabletop exercise: a director’s mailbox has sent an unusual payment request; an employee entered credentials into a fake cloud login page; a customer says they received suspicious emails from your domain. Ask who declares the incident, who contacts IT, how payments pause, where the log sits and what your holding message says.
After each exercise, fix one practical weakness: enable multi-factor authentication, remove unused admin accounts, confirm backups, update emergency contacts, ensure audit logs are retained or establish dual approval for bank-detail changes. The objective is not a perfect binder on a shelf. It is a team that can move from alarm to disciplined action.
Conclusion: calm is a control
Cyber incidents place owners under genuine pressure. Customers may be waiting, money may be at risk and the technical details may be unfamiliar. The answer is not to pretend the event is small. It is to make the first hour predictable: declare, contain, preserve, assess, communicate and plan.
Put this playbook into a one-page internal checklist today, name the four roles and test it this month. When the next suspicious login or phishing click occurs, your business will not need to invent a response under pressure. It can follow one.
