Why this matters (in trustee language)
Cyber incidents aren’t just “IT problems”. They can:
- Stop donations and bookings (website down, payment links broken)
- Expose supporter data (names, emails, addresses, Gift Aid info)
- Lead to fraud (invoice redirection, CEO fraud)
- Damage trust (which is hard to rebuild)
Trustees don’t need to be technical. You do need a plan.
If your charity gets hit by a cyber incident, the first hour matters more than the first day.
Most small organisations don’t fail because they “didn’t have cyber security”. They fail because nobody is sure what to do next: who decides, who contacts the bank, what evidence to keep, and when (or whether) to report to the ICO.
This post is an simple incident response checklist written for UK charity trustees, staff and volunteers. It’s not legal advice, but it will help you act quickly, reduce harm, and stay organised.
The 60-minute cyber incident checklist (print this)
1) Confirm it’s an incident (5 minutes)
You’re looking for signs like:
- Someone can’t log in (and password resets aren’t working)
- Strange emails sent from your account
- Website defaced or redirecting
- Antivirus alerts, ransomware messages, files encrypted
- Unusual bank/payment activity
Rule of thumb: if you’re unsure, treat it as real until proven otherwise.
2) Stop the bleeding (10–15 minutes)
Do the simplest containment steps first:
- Disconnect affected devices from the internet (Wi‑Fi off / unplug network cable)
- Pause access: disable compromised user accounts if you can
- Change passwords for key accounts from a clean device (not the one you suspect is infected)
- Turn on MFA/2FA immediately for email, website admin, banking, social accounts
If you use a managed IT/web provider, call them now and ask for containment first, investigation second.
3) Protect your money (10 minutes)
If there’s any chance of fraud:
- Call your bank/payment provider immediately (don’t wait for “proof”)
- If you’ve sent money to a fraudster, ask about urgent recall options
- Warn anyone who approves payments (two-person approval if possible)
4) Preserve evidence (5 minutes)
This is the bit people skip, then regret.
- Take photos/screenshots of error messages, ransom notes, suspicious emails
- Write down: who noticed what, when, and on which device/account
- Don’t wipe devices yet unless you’re told to by a qualified responder
5) Decide who is in charge (5 minutes)
Name an incident lead (even if temporary). For small charities this is often:
- A trustee with oversight + the most tech-confident staff member
- Your external IT/web support contact
One person coordinates. Everyone else feeds them information.
6) Communicate safely (10 minutes)
Assume your email might be compromised until you know otherwise.
- Use a secondary channel for coordination (phone, WhatsApp, Signal)
- Tell staff/volunteers not to click “weird” emails or approve payments
- If you suspect email compromise, warn key contacts that you may send updates from a different address
The next 24 hours: what trustees should make sure happens
A) Get expert help early
If you have a web/IT provider, bring them in. If you don’t, consider a trusted local provider who can:
- Check email forwarding rules (common in account takeovers)
- Secure your website admin accounts and hosting panel
- Review backups and restore options
- Help you document what happened
B) Work out what data is involved
You’re trying to answer:
- What systems were affected? (email, website, CRM, donor database, shared drive)
- What personal data might be exposed? (supporters, beneficiaries, staff)
- Is there a risk to people? (e.g., sensitive services, safeguarding)
C) Decide whether you need to report a personal data breach
Under UK GDPR, some personal data breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware.
Useful ICO guidance:
https://ico.org.uk/for-organisations/advice-for-small-organisations/personal-data-breaches/72-hours-how-to-respond-to-a-personal-data-breach/
https://ico.org.uk/for-organisations/advice-for-small-organisations/personal-data-breaches/72-hours-how-to-respond-to-a-personal-data-breach/
If you’re unsure, document your decision-making and get advice.
D) Notify people if there’s a high risk
If there’s a high risk to individuals (e.g., identity theft, safety risks), you may need to inform affected people promptly, in plain English, with practical steps they can take.
The next 7 days: recovery and prevention (without overcomplicating it)
1) Reset access properly
- Reset passwords for all key systems
- Remove old accounts for leavers
- Enforce MFA/2FA everywhere you can
2) Check backups and restore plans
- Do you have a recent backup?
- Can you restore it quickly?
- Who can do the restore if your main volunteer is away?
3) Do a short “what we’ll change” review
Keep it simple:
- What failed? (password reuse, no MFA, unclear roles, no backups)
- What will we change this month?
- What will we change this quarter?
This becomes your board-level cyber action plan.
A simple trustee cyber pack (what to prepare before anything happens)
If you do nothing else, create a one-page document with:
- Key logins list location (not the passwords themselves)
- Who to call: hosting provider, domain registrar, IT support, bank, payment provider
- Where backups are and who can access them
- Who is authorised to approve payments
- A draft “holding statement” for supporters
Store it somewhere accessible but secure.
Optional: a plain-English holding statement you can adapt
Use this if you need to acknowledge an incident quickly:
“We’re currently dealing with a technical issue affecting some of our online systems. We’re working with specialist support to investigate and restore services safely. If we need to contact anyone directly about their information, we will do so. Thank you for your patience.”
When it makes sense to get help with your website and systems
If your charity relies on online donations, bookings, or volunteer sign-ups, it’s worth treating your website and email like critical infrastructure.
Third Sector Studios helps UK charities and community groups with:
- Website care plans (updates, monitoring, backups)
- Securing WordPress and hosting
- Plain-English support for trustees and volunteers
If that’s useful, start here: https://thirdsectorstudios.org.uk/
FAQ
What should a charity do first after a cyber incident?
Contain the incident: disconnect affected devices, secure accounts from a clean device, enable MFA, and contact your bank/payment provider if there’s any risk of fraud.
Contain the incident: disconnect affected devices, secure accounts from a clean device, enable MFA, and contact your bank/payment provider if there’s any risk of fraud.
Do UK charities have to report a data breach within 72 hours?
Sometimes. UK GDPR requires reporting certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Check ICO guidance and document your decision.
Sometimes. UK GDPR requires reporting certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Check ICO guidance and document your decision.
Who should lead incident response in a small charity?
Name one incident lead (often a trustee + the most tech-confident staff member) to coordinate actions and communications, supported by your IT/web provider.
Name one incident lead (often a trustee + the most tech-confident staff member) to coordinate actions and communications, supported by your IT/web provider.
Disclaimer: This article is general information, not legal advice. If you’re unsure, seek advice for your specific circumstances.
Divider Text