简体中文
EnglishWhere to Find Cyber Attack Recovery Help on the NCSC Website
Updated
If you or your organisation has experienced a cyber attack or online scam, the NCSC website has a dedicated "Respond to a cyber attack" section with recovery resources. The guidance is split by who you are: individuals, sole traders and small organisations, and medium to large organisations. Start there, pick the path that matches your situation, and follow the linked step-by-step guides.
The three recovery paths
The NCSC separates its incident-response advice so you don't have to filter generic guidance. Each path is a distinct section on the site:
| Your situation | What the NCSC offers |
|---|---|
| Individual dealing with a scam or hacked account | Advice for individuals to respond to an online scam or cyber attack, including a step-by-step guide to recovering a hacked account |
| Sole trader or small organisation | Advice for sole traders and small organisations to respond to cyber attacks, covering online scams and attacks |
| Medium or large organisation | Advice for medium to large organisations to help respond to a cyber incident |
The site frames all three around the same message: being a victim is worrying, and resources and support are available to help you recover.
How to use the section
- Open the "Respond to a cyber attack" area from the main navigation. The homepage also surfaces it directly under "Experienced a cyber attack? Find resources to help you or your organisation to recover."
- Choose your audience path using the table above. If you're unsure, individuals and sole traders should start with the individual or small-organisation pages; the medium/large organisation path assumes you have internal incident response capacity.
- Follow the linked guides. For account compromise specifically, the "Recovering a hacked account" guide walks through recovery step by step. For organisations, the section connects to broader cyber resilience resources so you can both recover and reduce the chance of repeat incidents.
- Use the wider guidance library afterwards. Once the immediate incident is handled, the "Advice & guidance" area and audience-specific hubs (You & your family; Small & medium sized organisations; Large organisations; Public sector; Cyber security professionals; Self employed & sole traders) hold preventive guidance such as Cyber Essentials and the Cyber Assessment Framework.
What else is on the site
- Cyber Essentials — a scheme to protect businesses against the most common cyber threats.
- Cyber Assessment Framework (CAF) — guidance for organisations that play a vital role in UK day-to-day life, focused on essential functions.
- Training and awareness material, such as cyber security training for school staff.
- Current threat context, including NCSC blog posts and joint international advisories on malicious actors.
- A subscription option (the site links to a subscribe/register page) if you want NCSC updates by email.
Common sticking points
- Picking the wrong audience path. A sole trader who clicks the medium/large organisation guidance will get advice aimed at formal incident response teams. Match the path to your actual size.
- Expecting a reporting hotline. The NCSC site is a guidance resource; the recovery pages point you to advice and support rather than acting as an emergency service. For live incidents, follow the guidance and your organisation's own escalation process.
- Stopping at recovery. The recovery guides fix the immediate problem; the resilience and prevention content (Cyber Essentials, CAF) is where you reduce future risk.