Support desk — Monday to Friday, 08:30 to 17:30Client AreaGet help now →

Security Centre

Free · No sign-upOnline 24/7

Security Centre

Free tools and plain-English guidance for UK businesses. Check a link before you click it, find out whether your email can be forged, and see what the NCSC is actually warning about right now. If something has already gone wrong, start with the red button below.

We think we've been hackedCheck a suspicious linkCurrent threatsCheck a passwordAll free tools
🚨WE THINK WE'VE BEEN HACKEDOpen this for what to do in the next ten minutes

Work through this in order. It is written for whoever is nearest the problem, not for an IT specialist. You do not need to know what has happened yet — for a ransomware screen, a hijacked mailbox or a fraudulent invoice, the first few steps are the same.

Do this now

  1. Disconnect it, but leave it switched on. Unplug the network cable or turn off the Wi-Fi. Powering the machine down wipes evidence held in memory, and part-way through ransomware it can leave files encrypted beyond recovery.
  2. Move to a different device. If that machine is compromised, every password you type into it is read as you type it.
  3. Change the email password first. Email is the master key — it resets everything else. Then change anything that shared that password.
  4. Turn on multi-factor authentication for email and banking if it is not already on. This is the single change that stops most account takeovers from continuing.
  5. Tell your IT support, and tell your bank if invoices, payment details or bank details appear anywhere in this.

Do not do this

  • Do not wipe or rebuild it yet. That machine is the only record of how they got in and what they reached. Rebuilt too early, you often restore the same weakness or reinfect from the backup.
  • Do not pay a ransom before taking advice. Paying does not reliably get the data back, it funds the next attack, and if the group behind it is sanctioned, paying can be a criminal offence in the UK.
  • Do not delete the suspicious email, the logs or the files. They are the evidence, and without them nobody can tell you what was taken.
  • Do not discuss it inside the compromised system. If they are reading the mailbox or the Teams chat, talking about it there simply tells them you have noticed.

Then, within days

  1. Work out whose data was involved. If personal data has probably been exposed and there is a risk to those people, the ICO must be told within 72 hours of you becoming aware. That clock starts now, not when the investigation finishes.
  2. Report it to Action Fraud on 0300 123 2040. For a live incident affecting a UK organisation, the NCSC takes reports too.
  3. Tell the people affected where the risk to them is high — customers, staff, anyone whose details were in there.
  4. Check your mail rules. Attackers routinely add a forwarding or auto-delete rule so that replies, and warnings, never reach you. It is the step most often missed.

Not sure how serious it is? That is normal in the first hour, and it is exactly the right time to call rather than the wrong one. If you are already an EasyLifeIT customer, call and say the word incident and we will treat it as one.

0333 322 1100

Is your password already on a criminal's list?

Attackers do not guess passwords one at a time any more. They work from lists of billions that have already leaked from other companies' breaches. If yours is on one of those lists, it does not matter how clever it looked when you chose it.

Your password does not leave this page, and here is exactly why. Your browser turns what you type into a 40-character fingerprint, then sends only the first five characters of that fingerprint to the breach list. It gets back every known fingerprint starting with those five — usually around a thousand of them — and does the comparison here, on your own machine. Nobody, us included, can tell which password you checked or whether it was found.
And a habit worth keeping: be suspicious of any website asking for your password, including this one. What makes this safe is the five-character trick above, and you can watch it happen in your browser's network tab if you want to. If a site cannot explain itself that plainly, do not type anything into it.

Free tools, no sign-up

Everything here is free whether you are a customer or not. None of it asks for your details, and none of it is a trial that stops working.

✉Email security checkerFind out whether a criminal can send email that looks like it came from your own domain. Checks SPF, DKIM and DMARC and explains what is wrong in English.Check my domain🛡Microsoft 365 security checkA read-only script you run yourself. Tells you how many staff have no multi-factor authentication, how many administrators you have, and why that matters.Check my tenant✓Cyber Essentials readinessSee how close you are to passing before you spend anything on being assessed.Check my readiness⚑Report a suspicious emailNot sure about an email? Send it to us and a person will tell you whether it is a scam. No charge, customer or not.Send it to us🎣Spot the phishReal emails, some genuine and some not. Can your team tell them apart? Worth ten minutes of a team meeting.Take the test📚Learning CentreGuides written in plain English. No jargon, no scare tactics and no sales pitch.Browse the guides

What is actually happening right now

These two feeds come straight from the source and refresh themselves, so this page stays current without anybody at EasyLifeIT having to remember to update it. The NCSC publishes every few weeks rather than every day — a headline from last week means nothing new has been declared, not that this page has gone stale. Everything is dated so you can judge that for yourself.

🛡

From the NCSC

The UK's National Cyber Security Centre, part of GCHQ

Live
More from ncsc.gov.uk ↗
☁

From Microsoft's security team

Threat research, incident write-ups and product news

Live
More from the Microsoft Security Blog ↗

Worth checking elsewhere

Two things we have deliberately not rebuilt here. The originals are better than anything we would put in front of you, so these go straight to them.

☁Is Microsoft 365 down?Microsoft's official status page. Worth checking before you assume the worst — a lot of what looks like a breach on a Monday morning turns out to be Exchange Online having a bad day.status.cloud.microsoft ↗🔑Has your email been in a breach?Have I Been Pwned, run by Troy Hunt. It is the one the industry actually uses, it is free, and it never asks you for your password.haveibeenpwned.com ↗

Would you rather not have to think about any of this?

That is the job. We look after Microsoft 365, the patching, the backups and the awkward phone call at half past four on a Friday, for businesses who would rather get on with their actual work. UK based, and you speak to the same people each time.

Have a look at what that costs, or just call and describe the problem. There is no sales process and no obligation to do anything afterwards.

See the plans0333 322 1100