Cyberattack response for companies in the United Kingdom
Evidence, reports, counsel, insurance and public communications after a cyberattack in the United Kingdom.
Di article body no dey available for dis language; showing English.
Use this checklist when a company operating in the United Kingdom suspects an attack. Choose the jurisdiction from the legal entity, affected information and operations; the reading language does not determine which law applies. Sources checked on 20 October 2026. This is a Mithril editorial workflow, not an official filing form. Confirm applicable duties with qualified counsel.
## 1. Establish the response team and preserve facts
Name an incident commander, technical lead, legal reviewer, communications owner and finance contact. Choose a trusted contact channel if the corporate account or email system may be compromised. Authorize the technical scope before collection or changes. Preserve supplied originals, acquisition times, time zones and hashes; keep summaries and translations as separate versions.
Prepare a minimum factual packet: discovery and awareness times, affected services, confirmed impact, suspected impact, evidence references, open questions and current owners. Unknown leakage or an uncertain person count stays unknown. Run technical response, counsel, reporting, communications and insurance in parallel; an unfinished investigation must not silently consume another task’s deadline.
## 2. Check local reporting routes and deadlines
Under UK GDPR, report a personal-data breach to the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to risk people’s rights and freedoms. High-risk breaches can require separate notice to individuals without undue delay. [ICO — Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/)
Use the NCSC incident route for the relevant cyber incident. Report Fraud takes cybercrime and fraud reports in England, Wales and Northern Ireland; confirm the appropriate police route for Scotland. [NCSC — Report a cyber incident](https://report.ncsc.gov.uk/)
Record the awareness time and risk decision. Do not wait for a complete investigation before a required initial notice, and do not treat a NCSC report as an ICO notification. [Report Fraud — Reporting fraud and cyber crime](https://www.reportfraud.police.uk/reporting-a-fraud/)
## 3. Brief counsel and review insurance early
Give counsel a restricted brief with the factual timeline, source inventory, known gaps and jurisdiction questions. Verify professional identity, conflicts, engagement scope and fees. Ask the policyholder’s insurer or broker about notice timing, panel providers and any preapproval before commissioning work. Separate notification from a later claim, coverage decision or payment. Record evidenced costs and uncertain losses without promising reimbursement.
## 4. Prepare public communications and direct notices
Prepare one approved factual version for each audience. A public statement should cover confirmed service impact, actions being taken, what remains under investigation, protective steps, a verified contact route and the next update. Do not invent attribution, promise a recovery date or describe unobserved exfiltration as “no data lost”. A press release does not automatically replace direct notices required by law or contract.
Draft structure: “We identified [confirmed event] on [time and zone]. [Confirmed impact]. We are taking [approved actions]. We are investigating [unknowns]. Affected people can [reviewed protective steps]. Contact [verified route]. The next update is planned for [approved time].” Replace every placeholder, review the exact version and record approval before publication.
## 5. Use the Agent preparation plan
The proposed Mithril Agent/Registry integration defines 12 preparation and tracking capabilities: evidence inventory, source-linked timeline, next actions, obligation review, recipient-specific drafts, counsel briefs, communications, loss schedules and receipt reconciliation. This enterprise workflow is planned. Publishing this guide does not make it an available executor or an official reporting connector. Authorized people submit and publish through the appropriate channels; any future delegated connector needs separate qualification.
## 6. Download the country process
The BPMN 2.0 file is an authored, non-executable reference with five concurrent workstreams, human decisions, review escalation and accepted handoffs. It includes this country’s source context, not an official authority process. The current Mithril execution subset does not implement every element in this model.
- [Download BPMN for the United Kingdom (English)](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/gb/en.bpmn)
- [Read the planned capability contract](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/capabilities.json)
- [View artifact hashes and versions](https://blog.mithril.fund/processes/enterprise-cyber-response/v0.1.0/manifest.json)
## 7. Keep an action and receipt ledger
For each action, record the recipient and purpose, accountable owner, source and trigger for a candidate deadline, confirmed review time, approved payload/version, dispatch record, official receipt and next step. Submission, receipt, acceptance, coverage and recovery are different outcomes. Reconcile an unknown result before retrying. Close operational response only after recovery approval and accepted ownership of continuing legal, regulatory and insurer work.
## Official sources for this country
- [ICO — Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/)
- [NCSC — Report a cyber incident](https://report.ncsc.gov.uk/)
- [Report Fraud — Reporting fraud and cyber crime](https://www.reportfraud.police.uk/reporting-a-fraud/)
[Compare the other country guides](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en)