What UK SMEs Should Do in the First 72 Hours After a Breach

When business owners think about a cyber security breach, their minds usually jump to catastrophic Hollywood scenarios: a masked hacker sitting in a dark room cracking codes while your screens flash red.

For the average UK small-to-medium-sized enterprise (SME), reality is far more mundane, and far more stressful. It looks like an employee clicking a convincing phishing link on a Tuesday morning, a laptop left on a train containing unencrypted customer data, or a sudden ransomware notification locking your core invoicing system.

When a security incident hits, panic is the default reaction. Adrenaline spikes, blame starts flying, and critical hours are lost.

However, how a business handles the first 72 hours after discovering a breach dictates whether it remains a manageable operational hiccup or spirals into a full-scale regulatory, financial, and reputational disaster.

The Golden Window: Why the First 72 Hours Matter

Under the UK GDPR, if a personal data breach occurs and is likely to result in a risk to the rights and freedoms of individuals, you have a legal obligation to report it to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it.

That 72-hour window moves fast. If you spend the first two days arguing about what happened or trying to cover it up, you run out of time to investigate, contain, and report accurately, which opens the door to severe ICO fines and stakeholder mistrust.

Step 1: Contain the Threat (Hours 0 to 6)

When smoke starts filling a room, you don’t start drafting a press release; you put out the fire. In a security incident, your immediate priority is containment and isolation.

• Isolate Affected Systems: If a workstation or server is compromised, disconnect it from the network immediately (unplug the ethernet cable or disable Wi-Fi) to stop malware or ransomware from spreading laterally across your systems.
• Revoke Compromised Credentials: If user accounts or admin logins have been compromised, force password resets immediately and terminate all active session tokens.
• Preserve Evidence: While containing the threat is vital, don’t delete system logs, error messages, or suspicious emails. Your IT support or forensic partners will need these digital footprints to understand how the breach happened.

Step 2: Assess and Investigate (Hours 6 to 24)

Once the bleeding has stopped, you need to establish the facts. Avoid guessing or jumping to conclusions. Work with your internal IT team or external security partner to answer four fundamental questions:

1. What happened? (What was the nature of the security breach?)
2. What data or systems were accessed? (Was it personal data, financial records, or commercially sensitive IP?)
3. How many individuals are affected? (Is this a localised error affecting one client, or does it impact hundreds of customers?)
4. Is the risk ongoing? (Are hackers still inside your network, or has the vulnerability been patched?)

Step 3: Notify and Communicate (Hours 24 to 48)

Transparency is critical, but communication must be strategic, calm, and coordinated.

• Consult Legal or DPO Support: Before firing off notifications, speak with your Data Protection Officer or compliance partner to evaluate whether the breach meets the threshold for mandatory ICO reporting.
• Inform the ICO (If Required): If personal data security has been compromised in a way that risks individuals’ rights and freedoms, submit your report to the ICO via their online portal within the 72-hour limit. Being proactive and transparent with the regulator counts heavily in your favour.
• Manage Stakeholders & Customers: If customer data is compromised, honesty is always the best policy. Prepare a clear, factual communication plan explaining what happened, what steps you have taken to secure their data, and what protective measures they should take (such as changing passwords). Avoid corporate spin or downplaying the situation.

Step 4: Recovery and Return to BAU (Hours 48 to 72+)

Once containment and notifications are handled, focus shifts to recovery and restoring Business As Usual (BAU).

• Restore from Clean Backups: If data was encrypted or corrupted by ransomware, restore systems using verified, clean offline backups, only after you have patched the vulnerability that allowed the attackers in.
• Conduct a Post-Incident Review: Bring your team together to perform a “blameless post-mortem.” Ask: How did this happen? Where did our controls fail? What can we do to ensure it never happens again?
• Update Your Risk Register: Feed the lessons learned straight back into your risk management framework. A breach is painful, but a breach you don’t learn from is a tragedy.

Turn Incident Response Into Resilience with Elmar

No business is 100% immune to cyber threats. True cyber resilience isn’t about pretending an incident will never happen; it’s about having a tested, calm, and structured playbook ready for when it does.

At Elmar Risk Management, we help UK SMEs establish robust information security frameworks, incident response plans, and data protection strategies that keep you compliant, prepared, and fully supported when the unexpected occurs.

Get in touch with Elmar Risk Management today to review your incident response readiness and protect your business future.