Cyber incident response
Under attack? Call 0800 0614 715.
If you’re dealing with ransomware, a compromised account or suspicious activity right now, don’t fill in a form. Call our incident responders and we’ll help you contain it, investigate and recover.
What to do now
The first steps matter most.
In the first hours of an incident, the right actions limit the damage and preserve the evidence you’ll need later. The wrong ones, such as wiping machines too early, can make recovery harder.
If you’re not sure what’s happening, treat it as an incident until you know otherwise, and get expert help early.
- Isolate affected devices from the network, but don’t switch them off
- Don’t wipe or rebuild systems yet: preserve evidence
- Change passwords from a clean device
- Call us on 0800 0614 715
- Consider your reporting duties: personal data breaches may need reporting to the ICO within 72 hours
How we help
From first call to full recovery.
Triage and containment
Understand what’s happening and stop it spreading.
Investigation
Find out how the attacker got in, what they did and what they took.
Eradication and recovery
Remove the attacker and restore systems safely.
Communication support
Help with updates for your board, staff, customers and regulators.
Lessons learned
A clear account of what happened and how to stop it happening again.
Readiness for next time
Plans, playbooks and exercises so you’re prepared.
Find out more →By the numbers
The threatin numbers.
25%
of UK businesses have a formal incident response plan (57% of medium, 76% of large)
31%
of UK businesses have a board member responsible for cyber
18
highly significant UK incidents in a year, up about 50%, the third annual rise
Source: NCSC Annual Review 2025
247 days
global average time to identify and contain a breach, up for the first time in five years
Source: IBM Cost of a Data Breach 2026
Why CyberQ Group
Expertise you can rely on.
CREST accredited
Independent testing to a standard recognised by government, regulators and insurers.
ISO 27001 certified
We hold ourselves to the same standard we help our clients achieve.
Globally resilient, 24/7/365
Teams in multiple locations, so cover never depends on a single site.
Birmingham HQ, five regions
Headquartered in Alpha Tower, supporting organisations across the UK, Europe, South Africa, the US and Asia.
Related services
Explore further.
Emergency Readiness & Response
Be ready before an incident, and recover fast after one.
Explore →Board Cyber Crisis Simulation
Prepare your board to lead through a real cyber crisis.
Explore →Managed XDR
24/7 threat detection and response from our Security Operations Centre.
Explore →Managed Email Security
Stop phishing, impersonation and malicious attachments before they land.
Explore →
Isolate affected devices from the network without switching them off, avoid wiping anything, change passwords from a clean device, and call us on 0800 0614 715.
Law enforcement and the UK’s National Cyber Security Centre advise against paying, as it doesn’t guarantee you’ll get your data back and funds criminal activity. The decision is yours; we’ll help you understand your options and recover.
If personal data is affected and the breach is likely to put people at risk, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware. Regulated sectors may have additional duties. You can also report cyber crime to Action Fraud.
A tested incident response plan, a board crisis simulation and 24/7 monitoring make the biggest difference. Our Emergency Readiness & Response service covers all three.
AskQ Health Check
How resilient are you, really?
Answer 13 quick questions and get a score across six areas, plus where to focus first. It takes about three minutes.
Get started
Talk to our team.
Book a call with a CyberQ specialist, or call us on 0800 0614 715. No obligation, no jargon.