Nimbo Shield by Nimbosoft Free check
Help · step by step

I think I've been hacked

Take a breath. Most problems can be sorted out. Pick what's happened and follow the steps in order.

Money has gone, or I paid a fake invoice
  1. Ring your bank now, using the number on the back of your card. The sooner they know, the better the chance of getting money back.
  2. Report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk. You'll get a crime reference number.
  3. Don't reply to the fraudster or delete their emails; your bank and the police may need them.
  4. Tell the real supplier, so they can warn others.
Someone is in my email account
  1. Change your email password straight away, from a different device if you can. Make it long and new.
  2. Switch on two-step login (a code on your phone).
  3. Look in your email settings for forwarding rules you didn't set up, and delete them. Fraudsters use these to read your emails secretly.
  4. Sign out of all other sessions (in the security settings).
  5. Warn customers and suppliers that emails from you may have been fake, especially about bank details.
My website has been changed or shows strange things
  1. Contact your web host. They can take it offline and restore a clean backup.
  2. Change every password linked to the website: hosting account, website admin, and the email address used for them.
  3. Ask your web designer to update all website software and plugins before it goes back online.
  4. If Google shows a red warning, request a review in Google Search Console once it's clean.
My files are locked and someone wants payment (ransomware)
  1. Unplug the affected computers from the internet (pull the cable, turn off Wi-Fi). Don't switch them off.
  2. Don't pay. Paying often doesn't get files back and marks you as a target.
  3. Report it to Action Fraud on 0300 123 2040. The National Cyber Security Centre (ncsc.gov.uk) has free guidance.
  4. Contact your insurer if you have cyber insurance; many include an emergency helpline.
  5. Restore from backups only once the computers have been cleaned or replaced.
Customer data may have been taken
  1. Write down what happened and when. You'll need this.
  2. If people's personal details could be misused, you may need to tell the ICO (ico.org.uk, 0303 123 1113) within 72 hours. Their website has a quick self-assessment.
  3. If card details may be involved, tell your card payment provider straight away.
  4. Tell affected customers what happened and what they should watch for.
I clicked a link or opened an attachment I shouldn't have
  1. If you typed a password into the page, change that password now (and anywhere else you use it).
  2. If you gave card or bank details, ring your bank.
  3. Run a full virus scan (Microsoft Defender on Windows is fine).
  4. Forward the email to report@phishing.gov.uk so it can be taken down.

Stop it happening again

Nimbo Shield checks your website and email for the gaps criminals use, and warns you the same day about new threats. Try it free for 14 days.

Start free trial