Cyber insurance

Cyber attack: what to do in the first 72 hours

Reviewed by the Apex broking team · Last reviewed 2026-10-22

In the first 72 hours after a cyber attack, contain it without destroying evidence, call your insurer's incident line or broker, and decide whether to report to the ICO. The order matters, because the first hours can decide how well your cyber policy responds and whether you meet legal deadlines.

Part of: PHP2Shell and cyber insurance

In short

Contain the attack by isolating affected systems rather than switching them off or wiping them, so evidence survives. Call your insurer's incident response line, or your broker, before appointing your own experts or engaging with attackers: many cyber policies provide a 24/7 helpline and panel responders, and some require consent before costs are incurred or a ransom is discussed. Keep a decision log and preserve logs. If personal data is involved, report to the ICO without undue delay and, where feasible, within 72 hours of becoming aware where a risk to people is likely, and tell affected people if the risk is high. Then work through police, regulator, bank, customer and contract notifications.

What to do in the first 72 hours after a cyber attack

Last updated 22 October 2026. This is a broker's checklist, not technical incident response advice. Your IT provider, your insurer's appointed responders and official NCSC guidance should lead on the technical side. Policy terms vary, so treat every insurance point below as "check your wording".

When	Priorities
First hour	Contain, preserve evidence, call your insurer's incident line or your broker, start a decision log
Hours 1 to 24	Work with the insurer's responders, establish scope, decide whether personal data is affected, stop staff engaging with attackers
Hours 24 to 72	ICO report if required, other notifications, business interruption records, customer and contract communications

First hour: contain without destroying evidence, then call for help

Contain, don't wipe. The NCSC's guidance on disruptive cyber attacks says disconnecting systems can stop attackers issuing further commands and preserve forensic evidence, while shutting them down can lose investigative evidence. Investigate before you restore: rushing recovery "can significantly increase risk".
Call your insurer's incident line or your broker first. Many cyber policies provide a 24/7 helpline and access to panel responders such as IT forensics, lawyers and PR advisers, though the arrangements depend on the wording. The NCSC's ransomware payment guidance also suggests telling your insurer or broker promptly, as they can often recommend incident response firms.
Preserve logs. Keep server, firewall, email and access logs, and stop retention settings overwriting them. Investigators, and your insurer, will want them.
Start a decision log. Record what was found and when, what was decided, by whom and why. The NCSC recommends a central record to capture and share incident information; keep it somewhere the attack has not reached.
Get consent before you spend. Many cyber policies require the insurer's consent before you appoint your own experts, incur costs, admit liability, or negotiate or pay a ransom. Where the policy requires consent, costs incurred without it may not be covered.
Stop staff engaging with attackers. Replying to an extortion message or negotiating informally can make things worse and may breach policy conditions. Route all contact through the incident lead and responders. A ransom payment may be unlawful if it reaches a UK-sanctioned party, and the FCA notes that the National Crime Agency strongly advises against paying.

For how responders, lawyers and insurers fit together, see cyber breach response coordination.

Do you have to report a cyber attack to the ICO within 72 hours?

If the attack is a personal data breach, the controller must notify the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it, under Article 33 of the UK GDPR. There is no duty to notify if the breach is unlikely to result in a risk to people's rights and freedoms. The ICO guide puts it simply: if a risk is likely, you must notify; if it is unlikely, you don't have to. A late report must give reasons for the delay.

Report in phases if needed. You can provide information in stages without further undue delay, so don't wait for the forensic report.
Tell affected people where the risk is high. Under Article 34, you must tell individuals without undue delay if the breach is likely to result in a high risk to them, subject to exceptions such as data protected by encryption.
Record every breach, including ones you decide not to report.
Processors, such as agencies or hosts handling client data, must tell the controller without undue delay. The controller decides on and makes the report.

Since 30 September 2026 the regulator's legal name is the Information Commission (GOV.UK), but it is still referred to as the ICO. See cyber incident notification for how regulatory and insurance notifications interact, and data breach liability for the claims that can follow.

Other notifications: FCA, police, NCSC, banks, customers and contracts

FCA-regulated firms. The FCA says firms should tell it as soon as they know of material cyber incidents, under Principle 11 and relevant provisions of SUP 15.3. New operational incident reporting rules in PS26/2 come into force on 18 March 2027. Check with your compliance adviser whether your incident is reportable; see SUP 15.
Police. An organisation suffering a live cyber attack can call Report Fraud (formerly Action Fraud) on 0300 123 2040, 24 hours a day. The Report Fraud service covers England, Wales and Northern Ireland and directs people in Scotland to report via 101.
NCSC. The government's cyber incident signposting service tells you where to report. The NCSC says reporting to it does not fulfil any legal or regulatory reporting requirement, so it does not replace an ICO or FCA report.
Your bank. If payments, banking credentials or invoices may be affected, tell your bank straight away. Payment diversion is often insured differently; see social engineering and crime cover.
Customers and contracts. Commercial contracts and data processing agreements may set their own breach notification deadlines. Check them early, ideally with the insurer's panel lawyers, and avoid saying anything that could be read as admitting liability.

How cyber insurance responds to each step

Step	Cover that may respond	Conditions to check
Calling the incident line	Incident or breach response costs	Use of the insurer's helpline or panel; prompt notification
Forensics and containment	Incident response and IT forensic costs	Consent before appointing your own firm
Legal advice and ICO report	Breach response and legal costs	Panel lawyers; consent
Telling affected people	Notification and credit monitoring costs	Consent; reasonable costs
Ransom or extortion demand	Cyber extortion, where included	Prior consent; legality, including sanctions
Restoring data and systems	Data restoration and system rebuild	Improvements beyond like-for-like commonly excluded
Lost income	Business interruption	Waiting period, indemnity period, records
Regulator investigation	Regulatory defence costs; fines only where insurable by law	Wording and insurability vary
Claims from customers or individuals	Privacy and network security liability	No admissions; notify claims promptly

Not every policy includes every section, and limits and sub-limits vary. See what cyber insurance actually pays for, first-party vs third-party cyber cover and ransomware: cyber vs property vs BI.

Business interruption records to keep

Cyber business interruption is commonly measured by lost income or profit and increased costs of working, after a waiting period. Start collecting evidence from day one:

when systems went down, which ones, and when each came back;
daily sales, orders, bookings or billable hours, compared with recent weeks and the same period last year;
cancelled orders, lost contracts and customer complaints;
extra costs such as overtime, temporary staff, hired equipment and manual workarounds;
invoices and approvals for every incident-related cost.

More on this in business interruption after a cyber attack.

PHP2Shell: why check for compromise even after patching

PHP2Shell shows why the 72 hours can start after the fix. On 21 October 2026 the PHP project released fixed versions for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619 (php.net), and several security firms reported exploitation attempts on 21 and 22 October 2026. Remote code execution lets an attacker run their own code on your web server, which can include planting a web shell: a malicious script left on the server to give continued access.

Updating PHP closes the hole, but does not remove anything already planted. If your server was exposed before you updated, the NCSC advice to monitor internet-facing PHP systems for malicious activity still applies. Ask your IT provider or host to check for unexpected files, new admin accounts and unusual connections. If they find signs of compromise, treat it as an incident and follow the steps above.

Use our guide to checking your PHP version to confirm what you run, and read does cyber insurance cover unpatched vulnerabilities? for the insurance angle. The PHP2Shell and cyber insurance hub brings it together.

For Apex clients: call us and we'll help you notify

If you are an Apex client and think you have been attacked, call your insurer's incident line and call us. We will help you notify your insurer of the incident or circumstance quickly and correctly, and check what your policy says about consent, panel responders and notification deadlines.

Apex is an insurance broker, not an incident response or IT security firm. The technical response comes from your insurer's panel and your IT provider. If you have no cyber cover, we can arrange it through our cyber proposal, or check your current policy's conditions on security, notification and incident response. Professional firms can read more in ransomware and professional firms.

Sources

Frequently asked

What should I do first after a cyber attack?

Contain it by isolating affected systems rather than switching them off or wiping them, so evidence survives. Then call your cyber insurer's incident response line or your broker before appointing your own experts. Start a written log of what happened and what you decided. If personal data may be affected, the 72-hour ICO clock may already be running.

Do I have to report a cyber attack to the ICO within 72 hours?

Only if it is a personal data breach likely to result in a risk to people's rights and freedoms. Then you must report without undue delay and, where feasible, within 72 hours of becoming aware of it. You can report in phases. If the risk to individuals is high, you must also tell them without undue delay.

Should I call my insurer or my IT provider first?

Ideally both, quickly. Many cyber policies give you a 24/7 incident line with panel responders, and some require the insurer's consent before you appoint your own experts or incur costs. Calling the insurer early helps you avoid costs that may not be covered. Your IT provider should still act to contain the attack.

Will cyber insurance pay a ransom?

Some cyber policies include cyber extortion cover, usually only with the insurer's prior consent and subject to the law. A payment may be unlawful if it reaches a sanctioned party. The National Crime Agency strongly advises against paying, and payment does not guarantee you get your data back. Never let staff negotiate with attackers on their own.

I've patched PHP2Shell. Could I still be compromised?

Possibly, if your server was exposed before you updated. Updating PHP closes the vulnerability but does not remove anything an attacker already installed, such as a web shell. Ask your IT provider or host to check for signs of compromise. If they find any, treat it as an incident and notify your insurer under your policy terms.

Get cyber cover in place, or check the policy you have

Start a cyber quote online in a few minutes, or ask a broker to check your current policy's patching and notification conditions. Or call 0117 325 0027.

Start a cyber quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.