Ways you might know you are in a cyber attack:
- being locked out of accounts, systems or documents, like losing access without explanation or getting repeated log-in failures
- messages or pop-ups asking for payment (“ransom”) to access files or return your system to normal
- people telling you about strange or unexpected emails coming from your account
Actions to take immediately
If you have a cyber response plan, follow it. If you don't have one, use our processes for cyber incidents:
Contact the people who need to be involved and informed. This usually includes your local authority, IT support team, and your designated safeguarding or security leads.
If you have an IT support provider (for example, your managed service provider or Trust IT team), call them immediately. You will need specialist IT help to resolve the incident.
Follow any instructions from your specialist IT support. This may include instructions to turn off affected devices or disconnect them from the network.
Think about who you need to communicate with now, for example staff or parents. Use our communication templates to send clear, consistent messages quickly.
Use your cyber response plan
Follow any existing guidance you have. Remember to log actions and times and save anything that might be useful to resolve the incident, or review the incident later.
Not sure what you need?
Use our incident response process to work out the type of issue and the right response.