What is a cyber attack?

A cyber attack is a deliberate attempt to break into, damage or disrupt computers, networks, websites or online accounts. Many attackers are after money or data, such as login details, card numbers or customer records they can use or sell. Others want to knock a website or system offline. Attacks hit businesses of every size, and individuals too.

Common types of cyber attacks

Some cyber attacks trick you into clicking a link, typing in a password or making a payment. Others use a weak spot in software. Several of the types below are malware, short for malicious software: a program that can damage your device or steal from it.

Phishing

Phishing is a message that pretends to come from someone you trust, such as your bank, a supplier or a colleague. It can arrive by email, text or social media. It wants you to click a link, open an attachment or hand over a password. In the UK government's Cyber Security Breaches Survey 2025/2026, 88% of businesses that found a breach or attack over the past year had experienced phishing. Learn the signs of phishing emails, check who really sent a message before you act on it, and don't click a link you weren't expecting.

Ransomware

Ransomware is malware that locks your files or systems and demands a payment to release them. Paying gives you no guarantee that you'll get your data back, and your computer will still be infected. The way out is a recent backup kept away from the infected system, such as a drive you only connect while you make the copy. For your website, our web hosting makes a backup every day, and from the Professional plan up you can restore a backup yourself. On the Starter plan, those backups still run, and you can add daily backups with restore to bring one back yourself.

Spyware

Spyware secretly collects what you type, such as usernames, passwords and card numbers, and sends it to the attacker. For a business, that can mean stolen logins to your bank, email or website. To keep it out, check that the antivirus software on every computer you use for work is switched on.

Trojans

A trojan is malware that looks like a normal program, so you install it yourself. Once it's on your device, it can open a back door for the attacker or install more malware. Download software only from the maker's own website or an official app store.

Worms

A worm is malware that spreads by itself between apps and devices. One infected computer on your network can quickly put the others at risk. Worms get in through weak spots in outdated software, so install updates as soon as they arrive.

Adware

Adware installs itself on your device and shows unwanted ads and pop-ups. Some adware also tracks what you do online, and a malicious ad can take you to a harmful website. Be wary of ads that pop up where they shouldn't, and remove programs you don't remember installing.

Password attacks

In a password attack, software guesses passwords over and over until one works, or the attacker tries passwords that leaked from another website. The UK's National Cyber Security Centre (NCSC) suggests a password made of three random words: long enough to be strong and still easy to remember. Use it for one account only, so a leak elsewhere won't open it. Our tips on creating a strong password show you how.

SQL injection

An SQL injection attack targets your website's database. The attacker types database commands into a field on your website, such as a search bar or a login form. If the website doesn't block them, the database can hand over private data, such as card numbers or other customer details. Keep your website's software up to date, and if your website runs on WordPress, its plugins too.

DDoS attacks

A DDoS attack floods your website or server with fake traffic from many devices at once. The aim is to overload the server, so your website slows down or real customers can't reach it at all. For an online shop, that means lost sales for as long as the attack lasts. A host with DDoS protection filters out much of that traffic.

Man-in-the-middle attacks

In a man-in-the-middle attack, someone secretly gets between you and the website or person you're talking to. They can read what you send, and even change it. It often happens on unsecured public Wi-Fi. A website that uses the HTTPS protocol encrypts the connection, which helps protect what you send. On public Wi-Fi, wait until you're on a connection you trust, such as your home Wi-Fi, before you log in to your bank.

Every one of our web hosting plans includes an SSL certificate, DDoS protection, regular malware scans and a daily backup of your website.

How to know if you have been hacked

A hack usually shows up as a change you didn't make, in one of your accounts, on your website or on your computer. Look out for signs like these:

• You can't log in to an account, or its security settings have changed.
• Messages or notifications have been sent from your account that you didn't send.
• Someone has logged in, or tried to, from a strange location or at an unusual time.
• Money has been transferred, or something bought, that you didn't approve.
• Your website shows pages, links or pop-ups you didn't add, or sends visitors to another website.
• Files on your computer won't open or have new names, or a message asks for payment to unlock them.

If you think a password has been exposed, you can check if your password has leaked in a data breach.

What to do if you have been hacked

If you've been hacked, act quickly to take back control and limit the damage. If your website was hacked, change its passwords first and tell your web host what you've seen. Then restore a backup made before the hack, one older than the date the infected files were last changed, and update the website's software and plugins. If ransomware encrypted the files on your computer, restore them from a backup you kept away from it.

For a hacked account, such as your email or a social media account, these steps come from the NCSC.

1. Contact the account's provider and follow its account recovery steps.
2. Check your email account for filters or forwarding rules you didn't set up.
3. Change the password of the hacked account, and of every account that uses the same password.
4. Log all devices and apps out of the account.
5. Set up 2-step verification (2SV), so a password alone isn't enough to log in.
6. Update your apps and devices.
7. Tell your contacts you were hacked, so they treat recent messages from your account with suspicion.
8. Check your bank statements and online shopping accounts for payments you didn't make.
9. If you've lost money, tell your bank and report it to Report Fraud (in Scotland, Police Scotland).

Suspicious emails you haven't fallen for can go to the NCSC, which works to take scam websites down: forward them to report@phishing.gov.uk.

What a cyber attack can cost a small business

According to the NCSC, small businesses (those with up to 49 employees) are a target for online crime too, so being small doesn't keep you safe. One attack can hit your business in several ways at once.

• Attackers can empty bank accounts, divert payments or demand a ransom. If you take card payments, your customers can lose money too.
• Customer records, passwords and business files can be stolen and sold or used for fraud.
• Under UK GDPR, anyone who uses personal data has to keep it secure, so a leak of customer data can leave you with a legal problem as well.
• While your website or systems are down, you may not be able to take orders and your team may not be able to work as normal.
• Customers may be less willing to buy from a business that lost their data.

How to prevent a cyber attack

The basics below make an attack on your business much less likely. You don't need to be a technical expert to put them in place.

• Backups: keep a recent copy of your important files and website, so ransomware or a mistake can't wipe out your work.
• Updates: install updates for your devices, apps and website as soon as they're available, and turn on automatic updates where you can. They close the weak spots that worms and other malware use.
• Passwords: give every account its own password, and switch on 2-step verification (2SV, also called 2FA) for email and banking, so a stolen password isn't enough to get in.
• Email: if you don't recognise the sender, don't click on any links or open attachments. Our email plans come with a virus and spam filter that catches a lot of it before it reaches you.
• Secure websites: only enter passwords or card details on websites whose address starts with https://, so nobody in between can read them.
• Your web host: choose a host whose plans include SSL certificates, so your website runs on HTTPS. Our guide to keeping your website secure goes through the rest.
• Staff: make sure everyone knows how to spot a phishing email and who to tell when something looks wrong.

If you start with one item on that list, make it the backup, because it's what gets your business running again after a ransomware attack. With Backup & Restore, your website, email and databases are copied every day, and you can bring back a backup from the last two weeks. It's included from the Professional plan up, and you can add it to Starter.