Skip to main contentSkip to navigationSkip to navigation
police
Any attack on your business should be reported to the police. Photograph: Joe Giddens/PA
Any attack on your business should be reported to the police. Photograph: Joe Giddens/PA

What you should do if your business is the victim of cybercrime

This article is more than 9 years old

It may not be top of every small firm’s to-do list, but it is essential to plan ahead and have a strategy in place in the event of a breach

Considering what they would do if their business was attacked by a hacker is probably the last thing an entrepreneur wants to ponder, especially with so many other pressing business issues to attend to. However, ask any IT expert and they will all agree – not having a plan of any kind is the most common regret among business owners once they have been attacked.

While large enterprises will generally have the IT equivalent of a “fire drill” at the ready, an SME might think they are unlikely to be a target and that they are fully protected by anti-virus software, says Peter Chadha, CEO of Dr Pete, which specialises in IT security for SMEs.

“Most SMEs, even the larger and more complex ones, don’t have a well-rehearsed incident management plan or know what counter measures they should take when they’ve been hacked,” he says.

“All too often we find they go into denial and don’t even trust their own IT guy. Instead they stick their head in the sand like an ostrich until a lion comes along to bite them.”

For that reason, if a company does not have an IT security specialist working for them, they most certainly need to know the number of a reputable firm so they can be called in if there is ever a problem.

Change passwords

When the worst does happen, the first thing a company should do will depend on the type of hack that has been committed. It will also depend on what information has been targeted, according to Danvers Baillieu, COO at secure communications provider, Hide My Ass.

“The very first thing to do, no matter what, is to change passwords, particularly those accounts which have administration rights and which have access to sensitive information that may have been targeted,” Baillieu says.

“The next stage will depend on what form of hack you’ve suffered. A very common form will make your website point to something pretty unsavoury, such as porn. For this you need to know the number to call at your website hosts to get the website pointing back at its proper content and, of course, you need to reset passwords with them, as well as on your own systems.

He adds: “If you detect a hack inside your business systems, the best advice is to isolate the server hosting the system or systems that have been targeted and pull out the network cable. This is so it can’t communicate with any other part of your IT infrastructure and the rest of the business is, hopefully, protected while you fix and rebuild or replace the server.”

Pull the plug

Another very common form of attack is known as ransomware. An employee may accidentally be tricked, typically by what is known as a phishing email, to click on a link for a rogue website. This will cause their computer to be locked with a message saying they need to pay a ransom before the screen can be unlocked.

If this happens, staff should be trained to never click on the message. Instead they should immediately disconnect the computer from the network, advises Andrew Tang, service director for security at IT business, MTI.

“If you become aware there’s ransomware or malware of any kind on a PC the first thing is to stop it spreading,” he says.

“You need to disconnect it from the network and then shut it down. If it won’t let you, just pull the power plug. You then need to have an up-to-date recovery disc or USB from your security provider that you can boot up from. It will scan the computer, and hopefully identify and remove the malware. You then need to do the same for every computer in the office to make sure they’re not infected as well.”

In case you do not have a recovery disc or software to reboot and scan a PC on a USB, search online and you will find many well-known anti-virus companies offering a free, trial download.

Time to ‘fess up?

In addition to IT concerns, there are legal issues surrounding any form of attack. First of all, any attack on your business should be reported to the police. You may wonder if there is any point but security experts claim that law enforcement is getting better at dealing with, or at least recording, hacking incidents.

Most importantly, though, a decision has to be taken over whether the company needs to report the attack to the Information Commissioner’s Office (ICO). Those looking for firm guidelines will be sorely disappointed, however, warns Paul Glass, a senior associate at law firm Taylor Wessing. Notification is a grey area.

“It’s a balancing act between the sensitivity of data taken and the volume,” he says.

“If we’re talking just names and telephone numbers of a few customers, you’re probably ok. But if there are lots that have gone missing, then you probably should inform the ICO.

“On the other hand, if only a small amount of data was lost for a couple of people, such as their credit card details or information or health details, then you would definitely need to tell the ICO and, most likely, the people involved.”

Companies which have good security in place and who have taken steps to make amends for a breach are unlikely to be punished. Those which have been shown to have handled data insecurely can be fined up to half a million pounds. Typically, though, fines tend to be a few tens of thousands of pounds.

However, at some stage a draft EU bill which has been chopped and changed in Brussels for the past couple of years might well bring in a tougher regime. The final wording may change but it will likely be more prescriptive on reporting hacks within a specified time frame and, perhaps more alarmingly, is likely, under its current form, to raise the maximum fine level to 100m Euros or 5% of global turnover.

This will render reporting less of a grey area and make it even more imperative companies have good security systems and legal support to show they take data protection seriously and have met their legal obligations to report any incidents.

Sign up to become a member of the Guardian Small Business Network here for more advice, insight and best practice direct to your inbox.

Comments (…)

Sign in or create your Guardian account to join the discussion

Most viewed

Most viewed