When a small-business website is compromised, the first 72 hours determine legal exposure, customer harm and reputational damage. This playbook gives owners and web studios an ordered, practical checklist: what to do in the first hour, in the first day, and by 72 hours; how to prepare ICO reporting; what to say to customers; and when to call external help.
One-page quick start: first hour, 4–24 hours, 24–72 hours
- First hour (contain)
- Take the site offline or show a maintenance page to stop further data exposure.
- Change administrative credentials and revoke third-party API keys suspected of compromise.
- Preserve evidence: do not overwrite logs, take host and database snapshots.
- Notify your web studio and an internal incident owner.
- 4–24 hours (triage)
- Confirm scope: which systems, databases and records were affected.
- Identify affected personal data categories (names, emails, payment data, etc.).
- Decide immediate mitigations (password resets for affected users, MFA enforcement).
- Start a chronological incident log recording who did what and when.
- 24–72 hours (decide & report)
- Assess whether the breach is likely to result in risk to individuals’ rights and freedoms; if so, prepare to notify the ICO within 72 hours of becoming aware.
- Draft customer communications and prepare for press/website notices.
- Engage external responders if required (forensics, legal or PR).
Triage checklist for web teams (technical actions)
- Preserve logs and evidence
- Snapshot server and application logs (web, database, access logs) to a separate, read-only location.
- Export timestamps, HTTP requests, and anomalous user-agent strings.
- Isolate and contain
- Isolate compromised hosts from the network; if necessary, take them offline.
- Stop any job or scheduled task the attacker may be using.
- Revoke and rotate credentials
- Rotate admin passwords, API keys and any database credentials that might be leaked.
- Enforce two-step verification for accounts with access to sensitive systems where available.
- Secure backups
- Take immutable snapshots of backups; confirm backups are not infected before restoring.
Legal & regulatory decision tree (ICO-focused)
Under UK GDPR you must assess whether a personal data breach is likely to result in a risk to individuals’ rights and freedoms. If it is, you must notify the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach. The ICO’s guidance explains what to record and what to include in an initial report; it also permits reporting in instalments as facts emerge (ICO: Personal data breaches: a guide).
Practical decision rule:
- If personal data was exposed (names, emails, addresses, financial details), treat the incident as potentially reportable.
- If the exposed data could enable fraud, identity theft, physical harm or discrimination, you must notify the ICO within 72 hours.
- If you are unsure, make an early report and update it later — the ICO accepts initial reports and further updates (Responding to a cybersecurity incident).
Record for ICO reporting: timeline of discovery, affected data categories, likely consequences, mitigation steps taken, and contact details for your organisation.
Communications: who to tell and sample snippets
Be factual, concise and avoid speculation. Notify affected customers quickly if their personal data is compromised; delay wider press statements until you have confirmed scope.
Initial short customer notice (editable):
We recently detected unauthorised access to parts of our website. We have contained the incident and are investigating. At this stage, we believe the affected information includes [data types]. If you are affected, we will contact you directly with steps to protect your account. For updates, see [company status page link].
Press/social media short alert (when facts confirmed):
We experienced a security incident affecting [number/type] of accounts. We have contained the issue, notified the ICO where required, and are working with specialists to investigate. We will share further details as they are confirmed.
When to call external help
- Call an incident response/forensics provider if you cannot determine root cause, the breach involves payment data, or attackers maintain persistence.
- Report crime-level incidents to Action Fraud where fraud or extortion is involved, and consider contacting the NCSC if the incident is complex; the NCSC provides response and recovery guidance for small businesses (NCSC infographics for small businesses).
- Prepare a brief for responders: timeline, preserved logs, access credentials (rotated), and a nominated technical contact.
Post-incident: remediation and lessons learned
- Complete a root-cause analysis: how did the attacker enter, what controls failed, and whether backups were compromised.
- Implement low-cost mitigations recommended for small organisations: enforce strong passwords, roll out two-step verification, and verify backup integrity (see NCSC small-business guidance).
- Update your incident log, final ICO report (if filed), and customer communications. Plan a follow-up message summarising remediation and steps customers should take.
Need a studio-ready checklist or editable templates to use with clients? Use our website launch and incident checklist tool to produce a tailored action pack for your site and team: Website launch & incident checklist.
Further reading: ICO personal-data-breach guidance and the NCSC small-business response & recovery resources are primary UK sources for reporting and operational steps (ICO; NCSC).