Cybersecurity Breaches: How They Happen and the First 72 Hours

A cybersecurity breach is any incident in which an attacker, or an error, gives someone unauthorised access to your systems or data, or causes you to lose access to them. Where personal data is involved, UK data protection law adds a deadline: if the breach meets the reporting threshold, the ICO expects to hear from you within 72 hours of you becoming aware of it.

Most of the damage in a breach is shaped by the first few days: how quickly you contain it, how clearly you decide who needs to know, and how well you record what you did.

This article walks through how cybersecurity breaches happen, then gives a practical first-72-hours sequence for UK businesses.

How cybersecurity breaches happen

The NCSC defines a cyber incident broadly: unauthorised access, or attempted access, to your IT systems, including malware, ransomware, phishing and denial of service, as well as accidents such as fire, flood or theft.

In practice, most breaches follow a recognisable path rather than a single event.

• Initial access: a phishing email, a stolen password, an unpatched internet-facing system or a compromised supplier.
• Foothold and escalation: the attacker creates accounts, gains admin rights and maps the network.
• Data theft or preparation: files are copied out, or backups are located and disabled.
• Impact: ransomware is deployed, data is published or money is diverted.
• Detection and containment: someone notices, and the clock starts for any reporting duty.

The IBM Cost of a Data Breach Report 2025 (UK) found that UK organisations using AI and automation extensively in security took 148 days to identify and 42 days to contain a breach, against 168 and 64 days for those that did not. Even the better figure shows how long attackers can remain inside before anyone reacts.

Common causes of breaches

Two large studies give a useful picture of how attackers get in. Neither is a forecast for your business, but both point to the same basics.

Sources: IBM Cost of a Data Breach Report 2025 (UK) and Verizon 2026 Data Breach Investigations Report. The studies measure different samples, so compare the direction rather than the exact percentages.

Supplier risk appears in both. Our article on supply chain risks and recent retail breaches covers that angle, so it is not repeated here. For the phishing route, see what phishing is and how to prevent it.

A practical consequence: reduce the routes before you rehearse the response. Applying security updates promptly, enforcing multi-factor authentication and limiting supplier access remove several of the most common entry points at once.

The first hours: contain and record

The ICO's guidance for smaller organisations starts with staying calm, starting a log and establishing the facts. Applied to a cyber incident, the first few hours look like this:

• Call your IT or security provider. If you have 24/7 helpdesk cover, use it now.
• Start a decision log: time, what was found, who was told, what was done and why.
• Contain: isolate affected devices, disable compromised accounts, reset credentials and block malicious access. Avoid wiping evidence.
• Preserve backups and check they are intact before anything is restored.
• Call your insurer if you hold cyber cover, because policies often set notice conditions.

If an attack is live, the NCSC asks you to call its incident line on 0300 123 2040, which runs 24/7. Endpoint monitoring through managed EDR speeds up scoping because it shows which devices were touched.

Before an incident, agree who has authority to isolate systems at 2am. Delay caused by unclear permission is a common and avoidable source of extra damage.

A 72-hour response timeline

Use this as a planning frame and adapt it to your size and systems.

ICO notification within 72 hours

Under the ICO guidance on responding to a personal data breach, a breach that meets the reporting threshold must be reported to the ICO within 72 hours and without undue delay. The clock starts when you discover the breach, not when it happened.

If you lack full details, submit what you have on time and send a follow-up later. The ICO's online form takes around 30 minutes and cannot be saved part-way, so gather the facts first: what happened, when and how you found out, who may be affected, what you are doing and who the ICO should contact.

Even if you decide not to report, record the facts, your risk assessment and your reasoning. Our GDPR awareness training article explains why staff need to recognise a reportable breach quickly.

Notifying individuals, the NCSC and law enforcement

If the breach creates a high risk of harm to people, you must tell them without undue delay, with specific advice such as changing passwords or watching for phishing. If the risk is not high you need not tell them, though you can choose to.

• NCSC: call 0300 123 2040 for a live attack, or use the online service at report.ncsc.gov.uk for a significant attack that has already happened.
• Police and fraud reporting: NCSC reports pass to the Report Fraud Analysis Service, and the ICO also points organisations to Report Fraud.
• Insurer, customers and contract partners: check notice terms in policies and contracts.
• Sector regulators if you work in a regulated field.

The NCSC guidance on responding to a cyber attack splits response into preparing, identifying, resolving, reporting and learning, which is a sound structure to hold your plan against.

Sector rules may add duties of their own. If you supply a regulated organisation, check whether your contract sets a shorter notice period than the law does.

Communications during a breach

Silence causes as much damage as an unclear message. Keep communications factual, limited to what you have confirmed, and consistent across channels.

• Name one person to speak for the organisation and route all queries to them.
• Give staff a short holding statement so they do not speculate.
• Tell affected customers what happened, what data was involved and what they can do.
• Update on a set rhythm even when there is nothing new to say.
• Check every message against what you have told the ICO and your insurer.

Do not guess at causes or numbers. If the figure is unknown, say so and commit to a time for the next update.

Lessons and prevention afterwards

A post-incident review is where cybersecurity breaches become useful. Within a few weeks, cover root cause, detection gaps, decision quality and what to change. Typical outcomes include enforcing multi-factor authentication, tightening patching, testing backups, trimming supplier access and re-running training. See our guide on training employees on cybersecurity awareness for the people side.

An independent cyber security audit can validate fixes, and ongoing managed IT support keeps patching and monitoring consistent.

Rehearse the sequence at least once a year as a short tabletop exercise, using a plausible scenario such as a compromised mailbox. The NCSC's Exercise in a Box service is designed for exactly that, and the first run always exposes missing contact details or unclear decision rights.

Evidence, recovery and what to record

Recovery and evidence pull in different directions. Restoring service quickly is the business priority, but wiping systems too early can destroy what you need to understand the breach and answer the ICO or an insurer.

The ICO's list of what to record is a good template for any serious incident:

• what happened and why, as far as it is known;
• how many people, and which people, were involved;
• a timeline of events;
• facts as you uncover them, with corrections noted rather than overwritten;
• actions taken, including containment steps;
• your risk assessment and reasoning;
• your reporting decisions, including a decision not to report.

The NCSC small business guidance adds two practical points: keep regular backups of essential information and test restores, and keep contact details for partners and external helpers somewhere you can reach if normal communications are down. Restore only once you are confident the attacker no longer has access, otherwise you risk reinfection.

Conclusion

Cybersecurity breaches are managed, not wished away. Contain quickly, record everything, decide on ICO notification within 72 hours of discovery, tell affected people when the risk is high and learn from the result. If you want to test your plan before you need it, contact NetMonkeys.

Frequently Asked Questions (FAQs)