Charity Cyber Incident: What to Do in the First Day

A charity cyber incident is rarely just an IT problem. It can stop frontline teams accessing case files, prevent donations being processed, expose sensitive information about beneficiaries, and leave trustees answering difficult questions. The first 24 hours set the tone for recovery. Calm, structured decisions protect people, preserve evidence and give your charity the best chance of restoring services safely.

Charities are attractive targets because they hold valuable personal data, rely on donations and goodwill, and often operate with lean teams. Attackers know that pressure to reopen systems can lead to rushed decisions. A practical incident plan helps your people act with confidence rather than panic.

What counts as a charity cyber incident?

A cyber incident is any event that threatens the confidentiality, integrity or availability of your systems and data. It does not have to mean a sophisticated ransomware attack. A lost unencrypted laptop, a staff member entering Microsoft 365 credentials into a convincing fake sign-in page, or an unauthorised payment instruction can all require an immediate response.

Common warning signs include unexpected multi-factor authentication prompts, files renamed or inaccessible across shared drives, unusual inbox rules, unfamiliar administrator accounts, or suppliers receiving suspicious emails that appear to come from your charity. Staff may also report slow systems, locked accounts or payments sent to changed bank details.

Not every alert becomes a major breach. A contained phishing email deleted before anyone interacts with it is very different from a compromised account used to download beneficiary records. The right response depends on what happened, which systems are affected, what data may be involved and whether the incident is still active. However, every credible concern deserves prompt investigation.

The first hour: contain the problem without destroying evidence

Your immediate priority is to stop further harm. Ask the person who identifies the issue to record what they saw, when they saw it and which device or account was involved. Screenshots can help, but staff should not forward suspicious messages, click links to investigate or attempt a technical fix beyond their authority.

If a device appears compromised, disconnect it from Wi-Fi and the network where possible. Do not switch it off unless advised by your IT team or incident response specialist, as memory and activity data can be useful evidence. If an account is suspected, restrict access promptly by disabling the account or revoking active sessions, then reset credentials through a known-safe device.

For suspected payment fraud, call the bank immediately using a trusted number. Speed matters. Contact the intended supplier through an independently verified number as well, particularly if the fraud involved altered bank details or an intercepted invoice.

At this stage, avoid organisation-wide messages that speculate about the cause or scale of the problem. A clear internal instruction is enough: report related concerns to a nominated contact, do not use affected systems, and do not discuss the incident publicly. Good communication is controlled, factual and respectful of staff who may feel responsible.

Set up a small incident team

Even a small charity should know who makes decisions during an incident. This normally includes a senior leader with authority to prioritise services, the person responsible for IT or an external IT partner, and a lead for data protection and communications. Depending on the incident, finance, HR and safeguarding leads may need to be involved.

Keep one dated incident log. Record decisions, actions, timestamps, people involved and evidence gathered. This will support technical investigation, insurance discussions and any regulatory assessment later. It also prevents duplicated work when several people are trying to help at once.

Assess impact before restoring systems

The urge to get back online is understandable, especially where a charity delivers time-sensitive support. But restoring an infected device or compromised account too quickly can give an attacker a route back in. Containment and investigation should run alongside planning for safe continuity.

Start with four practical questions. Which services are unavailable? Who is affected, including beneficiaries and volunteers? What information could have been accessed or altered? Is there evidence that the attacker still has access?

Review sign-in logs, email forwarding rules, administrator activity, endpoint security alerts and backup status. For Microsoft 365 environments, this may include checking unusual locations, impossible-travel alerts, new consented applications and changes to multi-factor authentication methods. If your internal IT team does not have the tools or time to investigate thoroughly, bring in specialist support early. A fresh pair of experienced eyes can reduce both downtime and risk.

Your continuity plan may mean moving to manual processes, using approved alternative devices or temporarily changing how teams communicate with service users. This has trade-offs. Personal data should not be moved into personal email accounts, consumer messaging apps or unapproved spreadsheets simply because normal systems are unavailable. Workarounds need to be proportionate, documented and as secure as circumstances allow.

Reporting a charity cyber incident

Whether you must report an incident depends on the facts. If personal data has been breached and it is likely to create a risk to people’s rights and freedoms, the charity may need to notify the Information Commissioner’s Office within 72 hours of becoming aware of it. Where the risk is high, affected individuals may also need to be told directly and without undue delay.

Do not delay an assessment because every technical detail is not yet known. An initial report can be updated as the investigation develops. Equally, not every incident requires a report to the ICO. The key is to make a reasoned, documented decision based on the nature of the data, the number of people affected, the likely impact and the protections in place, such as encryption.

Serious incidents may also need reporting to the Charity Commission, particularly where they result in significant financial loss, serious harm, loss of sensitive data, major operational disruption or reputational damage. If criminal activity is suspected, preserve evidence and consider reporting it through the appropriate police fraud or cybercrime channel. Your cyber insurer, bank, funders and contractual partners may have notification requirements too.

Trustees should be informed early enough to exercise oversight, but they do not need a stream of untested technical detail. Give them a concise update covering the known facts, actions taken, current service impact, immediate decisions required and next review point.

Recover carefully, then learn properly

Recovery is not simply a matter of restoring files from backup. Before reconnecting systems, establish how the compromise occurred and close that route. This may involve patching a vulnerability, removing malicious inbox rules, resetting passwords, revoking sessions, checking privileged accounts and rebuilding affected devices.

Backups deserve particular scrutiny. Confirm they are intact, recent and isolated from the affected environment before relying on them. Test restoration rather than assuming it will work. In ransomware cases, secure copies of logs and affected systems may be needed for investigation before devices are rebuilt.

Once services are stable, hold a short, blameless review. The aim is not to identify who made a mistake. It is to understand where controls, processes or training did not give people enough protection. Staff who report a suspicious email quickly have done the right thing, even if they clicked first.

The most useful improvements are often straightforward: enforce multi-factor authentication, remove unused accounts, apply least-privilege access, improve email filtering, protect devices with managed endpoint security, patch consistently and test backups. Regular phishing awareness sessions help too, particularly when they are relevant to the charity’s actual work rather than generic scare stories.

For organisations with limited in-house capacity, a managed IT and cyber security partner can provide incident escalation, monitoring and a tested response process alongside everyday support. Breathe Technology works with charities and other mission-led organisations to make that support practical: clear ownership, experienced technical people and advice that helps leaders make decisions under pressure.

A cyber incident can feel deeply personal when your organisation exists to help others. The most reassuring preparation is simple: know who to call, practise the first actions, and make security part of everyday operations before an attacker decides to test it.