Who do you call first?

9 November 2026 · Giles Howland, Founder and Director

It's 7.40 on a Monday. Someone in accounts rings to say their screen has a ransom note on it. Then someone else does. Whoever takes those calls has a few minutes to make decisions that will shape the next few weeks.

Most businesses have never decided in advance who that person is, or who they ring next.

The first hour is about not making it worse

The instinct is to start fixing: reboot, restore, wipe the laptop. That's usually the wrong move. Switching machines off can destroy the evidence of how the attackers got in, and restoring too early can put your clean backup back into an environment they still control.

The first hour isn't for recovery. It's for containing the damage, protecting the evidence, and getting the right people involved in the right order.

The calls, in order

• Your own incident lead. One named person who takes charge, with a deputy. If nobody owns the first hour, everyone does something different.
• Your IT support or managed service provider. Ask them to isolate, not wipe: disconnect affected machines from the network and preserve what's on them.
• Your cyber insurer, before anyone else you'd pay. Many policies expect you to use their response line and their approved specialists. Engaging your own first can cause problems with a claim.
• The police. In England, Wales and Northern Ireland, report it to Report Fraud, the police's national service that replaced Action Fraud (reportfraud.police.uk). In Scotland, contact Police Scotland on 101.
• The ICO, if anyone's personal data may be exposed. That includes your own staff's: payroll, HR files, contact details. You may have to report it, normally within 72 hours of becoming aware, whether or not you pay the ICO's data protection fee. You only need to report if the breach is likely to put people at risk, but record your decision either way. The ICO has a short self-assessment on its website to help you decide.
• Your bank, if payment details or accounts could be involved.

If you're regulated, or part of critical national infrastructure

Everything above is the baseline for a typical small business. If you operate in a regulated sector, or provide services that are part of the UK's critical national infrastructure, such as energy, water, transport, health or digital infrastructure, your first hour may look different.

• You may have legal reporting duties of your own, to your sector regulator or competent authority, often with tighter deadlines than the ICO's. They can sit alongside your duty to the ICO, not instead of it.
• Your regulator may expect to hear from you before you act. Some sectors expect early notification, even while the facts are still unclear.
• Your contracts may set their own rules. Customers in regulated sectors often require their suppliers to report incidents to them within a set time. That can include you, even if you aren't regulated yourself.

If any of this applies to you, your first-hour plan should name those calls and their deadlines specifically. It's worth checking now, with your regulator's guidance or your advisers, rather than on the day.

Who can you reach when your email is down?

Here's the catch from last week's article. If your email and Teams are compromised, how do you make any of those calls? Where are the numbers? In the mailbox you can't open, or the address book on the laptop you've just unplugged?

A first-hour plan only works if it survives the systems going down. That means the key numbers written down, off your network, and a way to reach your own staff that doesn't depend on your own email.

Should you pay?

Don't decide in the first hour. Paying doesn't guarantee you get your data back, it doesn't remove the attackers, and it may mark you as someone who pays. Take advice from your insurer and the specialists first.

Five things to have ready before the day

1. A named incident lead and a deputy, who both know it's them.
2. The key numbers, printed: IT support, insurer, bank, and your own staff.
3. Your policy details and response line, somewhere you can reach without your systems.
4. A way to reach your people that doesn't go through your own email or chat.
5. A twenty-minute practice run. Walk through Monday 7.40 once, around a table.

Where ResilientOS fits

ResilientOS Ltd is building a ransomware recovery service for UK small businesses. It's designed so that, from the first hour, your people can be reached by text on their own phones and get to a clean workspace that's completely separate from your own systems, so the business keeps working while the investigation happens.

It's in development, and we're opening to our first customers soon. If you couldn't answer "who do you call first?" today, register your interest below.

Coming next week

Have you ever tried it? How to run a twenty-minute practice that finds the gaps in your plan before an attacker does.

← All articles