Keeping a cyber attack quiet makes the next one easier. Yours, and everyone else’s.

When a business is hit by a cyber attack, the first instinct of nearly everyone involved is to keep it quiet. I understand that completely. It feels like a failure, and nobody wants customers, competitors or the local paper to know. But having helped businesses through these moments, I’ve come to believe that silence is one of the things that keeps attacks working. Reporting a cyber attack to the people who need to know helps you, and it helps the business that would have been next.

How much goes unsaid

Last week’s NCSC Annual Review says the National Cyber Security Centre received 1,831 reports of cyber attacks in a year. Set that against the government’s own survey, which finds a large share of all UK businesses identifying a breach or an attack every twelve months. The gap between what happens and what gets reported is enormous.

It reaches right to the top. When the chairman of M&S gave evidence to MPs in July 2025 about the attack on his company, he said he had reason to believe two other large British companies had suffered major attacks in the previous few months that had gone unreported. If that’s the picture among household names with legal teams, imagine it among businesses with thirty staff.

Why businesses keep quiet

The reasons are human, and I don’t think any of them is foolish.

Shame. It feels as if you’ve been caught out. My industry has to take some blame for that, because we’ve spent years implying that victims must have done something stupid.

Fear of the regulator. People assume that telling the Information Commissioner’s Office means a fine.

Fear of customers leaving. If we tell them, they’ll go elsewhere.

Cautious advice. In the first hours, the safest-sounding instruction is “say nothing”. Sometimes that’s right for a day or two. It has a habit of becoming permanent.

It seems pointless. “The police won’t do anything, so why bother?”

Each of these deserves an honest answer, so here are mine.

What silence costs you

Start with the law, because it removes some of the choice. If personal data has been put at risk, you may have to tell the ICO within 72 hours of becoming aware, and tell the people affected if the risk to them is high. My guide on whether you need to report a breach goes through the test. Deciding not to, and being found out later, is far worse than reporting. The ICO has said repeatedly that it looks at how an organisation behaved, and that being open and cooperative counts in your favour. A late or hidden breach is the one that draws its attention.

Then your insurer. Most cyber policies require prompt notification. Sit on it for a week while you hope it goes away, and you may have damaged your own claim.

Then your customers. This is the part I feel most strongly about. If their details have been taken, criminals will use them to send convincing scam messages. A customer who has been warned is on guard. A customer who hasn’t is an easy target, and when they later discover that you knew, the damage to trust is far greater than the incident itself would have caused.

And then your own team. People watch what the business does when something goes wrong. If the response is to hush it up, they learn that hiding problems is how things are done here. You want the opposite habit, where someone mentions the odd email within the minute.

Attackers share what works. If the businesses they hit never do, the criminals are the only ones learning.

Ashley Adkins, fromIT

What silence costs everyone else

Criminal groups are organised. They reuse the same tools, the same tricks and the same stolen logins against one business after another. They trade notes. What they rely on is each victim believing it was a one-off and telling nobody.

Every report breaks that a little. When you tell Report Fraud, the national reporting service, it adds to a picture the police can act on, even if nobody rings you back about your own case. When you tell the NCSC, it can warn others about the same technique. When you tell your bank, an account used for fraud can be frozen before the next victim pays into it. When you tell another owner over coffee, they go back and check their own setup.

The law is heading the same way. The Cyber Security and Resilience Bill will require the organisations it covers to report significant incidents within 24 hours and follow up within 72. The government has also set out plans for mandatory reporting of ransomware. I’d expect the circle of who must report to keep widening.

What openness looks like when it’s done well

In October 2023 the British Library was hit by a ransomware attack that took its systems down for months. In March 2024 it published a detailed paper explaining what happened, what it had got wrong, and what others could learn, including the uncomfortable parts about ageing systems and missing multi-factor authentication. It was widely praised, and it has been read by security teams around the world. An embarrassing incident became a public service.

The retailers attacked in 2025 took a similar line. M&S and the Co-op spoke publicly, answered MPs’ questions and described what had happened in plain terms. I don’t believe either lost customers through being open. I suspect they kept some.

You don’t have to publish a report. But the principle scales down to a business of any size.

Quiet and private are different things

Being open doesn’t mean a press release. It means telling the right people, promptly, what they need to know. That’s a short list.

1. Your insurer. First, if you have cover. They may provide the specialists.
2. Specialist help. Someone who handles incidents, so that evidence is kept and the attacker is properly removed.
3. The ICO. If personal data is at risk, within 72 hours. You can report with what you know and update it later.
4. Report Fraud. For any cyber crime or fraud against your business. If an attack is under way, ring 0300 123 2040.
5. Your bank. Immediately, if money has moved or payment details may have been seen.
6. The people affected. Customers, staff and suppliers whose information or money is at risk. Say what happened, what it means for them, and what to do.
7. Your own team. A short, calm account of what happened and what’s changing. No hunt for someone to blame.

Two practical things make all of this easier. Write a holding message for customers now, while nothing is wrong, so you aren’t drafting it under pressure. And decide in advance who makes the call on reporting, so the 72 hours aren’t spent debating it.

I know how strong the pull is to say nothing. I’d ask you to think about the business down the road that will get the same email from the same criminals next week. Something you say might be the reason they don’t fall for it. Not long ago, someone else’s silence may have been the reason you did.

If you’re in the middle of this right now, fromIT’s cyber incident response can help with the technical side and with who to tell, in what order.