Why more transparency around cyber attacks is a good thing for everyone
Summary
The NCSC and the ICO explain why openness about cyber incidents — especially ransomware — benefits everyone. They dispel six common myths: that covering up incidents makes them go away; that reporting guarantees public exposure; that paying ransoms reliably fixes the problem; that offline backups remove all risk; that absence of evidence means no data loss; and that fines only follow visible data leaks. The blog argues organisations should report incidents, share lessons in trusted forums, and work with NCSC/ICO to reduce repeat attacks and improve the overall threat landscape.
Key Points
- Hushing up incidents prevents learning and encourages more attacks; information sharing reduces repeat victimisation.
- Reporting to the NCSC or law enforcement gives access to support and does not automatically make incidents public; confidentiality is respected.
- Paying ransoms is risky: decryption can fail, attackers may still leak data, and paying incentivises further crime.
- Good offline backups help, but don’t negate extortion risk when data has been exfiltrated.
- Absence of logging evidence isn’t proof data wasn’t taken — assume access until proven otherwise and report where thresholds are met.
- Fines relate to context and behaviour, not only to whether data was leaked; proactive engagement with authorities can influence regulatory outcomes.
- Criminal messaging may try to scare organisations into paying; early engagement with NCSC/ICO and trusted peers is the safer route.
Context and relevance
This guidance matters for organisations holding personal or sensitive data and for sectors critical to national services. Ransomware and data extortion are evolving: attackers increasingly steal data as leverage, so incident handling and transparency are central to both legal compliance and effective recovery. The NCSC and ICO emphasise coordinated response, regulatory clarity, and using trusted information-sharing groups to improve defences and reduce repeat incidents across industries.
Why should I read this?
Short version: don’t bury a breach and hope it disappears — that just hands a win to the crooks. Read this if you want practical, no-nonsense reasons to report incidents, stop rewarding attackers, and protect your organisation (and other people’s data) better. It’s a quick primer on what to do — and what not to believe — right after a cyber incident.