Limit the damage
Disconnect a device if malware is suspected, but do not wipe it. Stop remote-access sessions and suspicious calls. If business email in England is involved, warn anyone who approves invoices or supplier changes.
Been Hacked Fix England
Choose a county or region in England, then select the town or city closest to you.
Choose a county or region
Select a county in England to see its towns and cities.
BedfordshireView towns and citiesChoose areaBerkshireView towns and citiesChoose areaBristolView towns and citiesChoose areaBuckinghamshireView towns and citiesChoose areaCambridgeshireView towns and citiesChoose areaCheshireView towns and citiesChoose areaCornwallView towns and citiesChoose areaCumbriaView towns and citiesChoose areaDerbyshireView towns and citiesChoose areaDevonView towns and citiesChoose areaDorsetView towns and citiesChoose areaDurhamView towns and citiesChoose areaEast Riding of YorkshireView towns and citiesChoose areaEast SussexView towns and citiesChoose areaEssexView towns and citiesChoose areaGloucestershireView towns and citiesChoose areaGreater LondonView towns and citiesChoose areaGreater ManchesterView towns and citiesChoose areaHampshireView towns and citiesChoose areaHerefordshireView towns and citiesChoose areaHertfordshireView towns and citiesChoose areaIsle of WightView towns and citiesChoose areaKentView towns and citiesChoose areaLancashireView towns and citiesChoose areaLeicestershireView towns and citiesChoose areaLincolnshireView towns and citiesChoose areaMerseysideView towns and citiesChoose areaNorfolkView towns and citiesChoose areaNorth YorkshireView towns and citiesChoose areaNorthamptonshireView towns and citiesChoose areaNorthumberlandView towns and citiesChoose areaNottinghamshireView towns and citiesChoose areaOxfordshireView towns and citiesChoose areaRutlandView towns and citiesChoose areaShropshireView towns and citiesChoose areaSomersetView towns and citiesChoose areaSouth YorkshireView towns and citiesChoose areaStaffordshireView towns and citiesChoose areaSuffolkView towns and citiesChoose areaSurreyView towns and citiesChoose areaTyne and WearView towns and citiesChoose areaWarwickshireView towns and citiesChoose areaWest MidlandsView towns and citiesChoose areaWest SussexView towns and citiesChoose areaWest YorkshireView towns and citiesChoose areaWiltshireView towns and citiesChoose areaWorcestershireView towns and citiesChoose area
Check the signs
Recognise the warning signs before changing anything
Organisations that rely on email, Microsoft 365, online banking and cloud services can be disrupted by one compromised mailbox or reused password. In England, investigate password resets you did not request, files becoming unavailable or renamed and customers receiving messages you did not send promptly.
An incident may begin with a convincing call, a fake sign-in page, a supplier invoice, stolen browser credentials or an unpatched device. Write down what each person saw and when it happened. A reliable timeline is more useful than guessing how an attacker got in.
Not sure what to do first?
If you've been hacked, start with our step-by-step recovery checklist. It explains what to secure first, how to protect your email and accounts, what evidence to keep, and what to do next.
Recovery ChecklistWarning signSafe first action
password resets you did not requestReview recent sign-ins from a clean device.
files becoming unavailable or renamedPreserve the message or rule before removing it.
customers receiving messages you did not sendPause payment and verify through a known number.
Files renamed, encrypted or replaced by a ransom noteDisconnect the affected device from networks. Keep the note, contact your IT provider and leave backup drives disconnected.
Use a clean route
Use a separate phone or computer to contact your bank, IT provider and account services. Type known addresses yourself and avoid links in the message that caused concern.
Secure accounts
Start with email, Microsoft 365 or Google Workspace, banking, domain names and website administration. Reset unique passwords, review recovery details, remove unknown sessions and enable MFA.
Recovery in England
Check people, accounts, devices and backups together
An account compromise rarely stays inside one inbox. Attackers may study real conversations, imitate trusted contacts or wait until a genuine payment is due. Review sent items, deleted items, forwarding rules, delegated access, administrator roles and sign-in locations.
Ask staff to report unusual prompts without blame. Tell them which route to use if normal email cannot be trusted. Check laptops, phones and shared computers for unfamiliar browser extensions or remote tools.
Confirm backups exist, are separate from the affected system and can be restored before deleting or rebuilding anything. Keep screenshots, email headers, phone numbers, URLs, bank messages and login alerts.
A practical response plan
If your organisation works across more than one site, check any shared accounts, payment processes and supplier communication routes at the same time. Record each password reset, device isolation and bank call so recovery work is not repeated or missed.
If personal data may have been exposed, assess whether the relevant regulator and affected people need to be told. Check your cyber-insurance terms before taking actions that may affect a claim.
The aim is to regain control, understand the likely exposure and reduce the chance of a follow-up attack. Recovery should leave accounts, devices and working practices safer than they were before the incident.
Report fraud in England
Use official routes and trusted contact details
If money has moved, call your bank immediately and ask whether a transfer can be stopped or recalled. Report through Report Fraud. Use NCSC guidance for independent prevention and recovery guidance.
Keep reference numbers and note who was contacted. Reporting does not replace containment. Secure accounts and devices at the same time using a route the suspected attacker cannot monitor.
Frequently asked questions
What should I do first if I have been hacked in England?
Disconnect affected devices safely, pause payments, preserve messages and screenshots, then use a separate trusted device to secure important accounts.
Who should I report online fraud to in England?
Contact your bank immediately if money may be at risk. Use Report Fraud for the appropriate official reporting route.
Can Been Hacked Fix support someone in England remotely?
Yes. Initial containment, account checks and recovery planning can often start remotely. We will explain if a device needs hands-on investigation.
Should I wipe the affected computer or phone?
Not before evidence and recovery options have been checked. Wiping too early can remove useful logs, messages and other evidence.