How Healthcare Staff Should Report a Suspected Cyber Incident

If you think something has gone wrong with a computer, phone, email account or patient record at work, report it to your IT service desk or line manager straight away, even if you are not sure. You do not need proof, and a false alarm is far better than a missed incident. Fast internal reporting gives your organisation time to contain the problem and meet its legal deadlines.

This guide is for clinical and non-clinical staff in Ireland and the UK. It covers what to look for, what to do first and what to leave alone. How your organisation then investigates and notifies is a separate job, covered in our guide to data breach and cyber incident response for care providers.

What counts as a suspected cyber incident?

A cyber incident is anything that threatens the confidentiality, accuracy or availability of systems and information. You do not have to decide whether it is "serious enough". Report it if:

• You clicked a link or opened an attachment in an email that now looks suspicious, or you entered your password on a page you are no longer sure about.
• Your computer is behaving oddly: files will not open, names have changed, a ransom message appears, or programs start on their own.
• You get multi-factor authentication requests you did not trigger, or warnings that your password was changed.
• A work phone, laptop, tablet or USB stick is lost or stolen.
• Patient information was sent to the wrong person, posted in the wrong group chat or left visible on an unlocked screen.
• Someone phones or emails claiming to be from IT, a supplier or a senior colleague and asks for passwords, codes or urgent payments.
• A clinical system or shared drive suddenly becomes unavailable for no obvious reason.

Many incidents begin with a convincing email or phone call. Our phishing and social engineering awareness guide walks through the common tricks.

Report it quickly and internally

Use the route your organisation has set up. That is usually the IT service desk phone number, a security incident form or an out-of-hours on-call contact. Tell your line manager too, or the information governance or data protection lead if you are unsure who to contact.

A phone call is often better than an email. If your email account or device may be compromised, an attacker could be reading or deleting your messages. Report from a different, trusted device if you can.

Report even if it feels embarrassing. Clicking a well-crafted phishing link is a common mistake, and the security team would much rather hear about it in five minutes than five days.

What not to do

Well-meaning actions can make an incident worse or destroy evidence the investigators need. While you wait for advice:

• Do not delete anything. Leave the suspicious email, message, file or pop-up in place. Deleting it removes the clues IT needs to work out what happened and who else received it.
• Do not investigate yourself. Do not reply to the sender, click the link again "to check", forward the email to colleagues or run your own scans. Leave that to the people trained to do it.
• Do not pay, reply or negotiate. If you see a ransom demand, do not contact the attackers. The UK National Cyber Security Centre (NCSC) and UK law enforcement do not encourage paying ransoms, noting that payment does not guarantee data will be recovered and funds criminal activity (NCSC ransomware guidance, 2026).
• Do not switch the device off unless told to. Follow your IT team's instructions. Where malware is suspected, the NCSC advises disconnecting the affected device from all network connections, wired, wireless and mobile (NCSC ransomware guidance, 2026). Your IT team may ask you to do this while leaving the device powered on.

What to note down

While it is fresh, write a short note on paper or on a device you trust. Investigators find these details genuinely useful:

• When you noticed the problem, and when it may have started.
• What you saw: the sender's address, the subject line, any message on screen.
• What you did: links clicked, attachments opened, passwords entered, files downloaded.
• Which device, account and system were involved, and what patient or staff information might be affected.
• Who you have told and when.

Why speed matters: your organisation's clocks

You are not responsible for notifying regulators, but your report starts the clock for the people who are.

Data protection. Where a personal data breach is likely to put people at risk, the organisation must tell the regulator within 72 hours of becoming aware of it. In Ireland that is the Data Protection Commission (DPC); in the UK it is the Information Commissioner's Office (ICO). The ICO notes that the clock runs from when the breach is discovered, not from when it happened (ICO, 2025). A breach includes loss of data as well as unauthorised access, so a lost unencrypted phone can count. Our guide to GDPR data breach notification explains how organisations assess and report.

NIS2 in Ireland. The EU's NIS2 Directive sets the 24-hour, 72-hour and one-month stages above (NIS2 Directive, 2022), and health is one of its sectors of high criticality. Ireland had not yet passed its implementing law, the National Cyber Security Bill, as of October 2026, and the European Commission referred Ireland to the Court of Justice of the EU in July 2026 for failing to transpose the directive (Law Society Gazette, 2026).

The UK. NIS2 does not apply in the UK. Instead, the NIS Regulations 2018 require operators of essential services to report incidents within 72 hours. The Cyber Security and Resilience Bill would add a 24-hour initial notification followed by a fuller report at 72 hours, but it was still before Parliament in 2026 and its reporting duties would be brought in by later regulations (UK Government incident reporting factsheet, 2025).

This article is general information, not legal advice. Always follow your own organisation's incident procedure.

Frequently asked questions

Will I get in trouble for clicking a phishing link?

Most organisations treat prompt reporting as the right thing to do, and a quick report usually limits the damage. Staying quiet is what turns a small mistake into a serious incident.

What if it turns out to be nothing?

That is a good outcome. Security teams expect false alarms and would rather check ten harmless reports than miss one real attack.

Should I report a lost work phone if it has a passcode?

Yes. Report it immediately. IT may be able to lock or wipe it remotely, and the organisation still has to assess whether patient data was at risk.

Do I contact the DPC or ICO myself?

No. Report internally. Your organisation's data protection officer or information governance lead decides whether and how to notify the regulator.

Keep your reporting reflex sharp

Knowing what to look for, who to call and what to leave alone improves with practice. Learnsignal's healthcare compliance CPD courses offer practical learning you can fit around clinical work.