The National Cyber Security Centre – a part of GCHQ – unveiled the services to coincide with the latest phase of its Cyber Aware campaign, which is aiming to raise awareness of cyber security among the country’s small businesses, micro businesses and organisations and sole traders.   

With official statistics showing more than a third of small businesses suffered a cyber attack last year, the NCSC urged them to make use of its Cyber Action Plan and Check Your Cyber Security tools.  

The Cyber Action Plan can be completed online in under 5 minutes and results in tailored advice for businesses on how they can improve their cyber security. 

Check your Cyber Security – which is accessible via the Action Plan – can be used by any small organisation including schools and charities and enables non-tech users to identify and fix cyber security issues within their businesses. 

Small businesses are a common target for cyber criminals, with the Government’s last Cyber Breaches Survey revealing that 38% of the UK’s small businesses suffered a cyber incident over a 12-month period.  

The range of attacks can vary widely, from business email compromise to denial of service and ransomware attacks.  

Lindy Cameron, NCSC CEO said:  “Small businesses are the backbone of the UK, but we know that cyber criminals continue to view them as targets.   

“That’s why the NCSC has created the Cyber Action Plan and Check Your Cyber Security to help them boost their online defences in a matter of minutes.  

“I strongly encourage all small businesses to use these tools today to keep the cyber criminals out and their operations on track.”

Martin McTague, National Chair of the Federation of Small Businesses (FSB) said: “A fifth of small businesses see cybercrime as the most impactful crime in terms of both cost and disruption to their operations. We’re glad to see our recommendations to raise small firms’ awareness on cybersecurity has been taken forward in NCSC’s Cyber Aware campaign.

“Equipping small firms with the right tools and tailor-made guidance could enable them to be more cyber resilient and in turn reduce costs in real life.”

The Cyber Action Plan and Check Your Cyber Security are among the services within the NCSC’s Active Cyber Defence services, which help to protect the UK from millions of cyber attacks each year.  

The NCSC continues to offer a wide range of guidance, products and services to small organisations, including its Small Business Guide. 

Case study 1

“You work so long and so hard to build up social media pages and grow your following and everything had just gone.” Keri Ackling describes the impact of a cyber attack on her business, Snow Windows.  

My husband Tom and I own a business called Snow Windows, and we spray festive designs onto windows at Christmas time. Since 2015 we have worked hard to grow the business; these days we spray windows for celebrities, royals and huge department stores. 

But, in 2021 we received an email to our business account, and things took a turn from there.  

The email appeared to be from Instagram and it said that now that I was near 10k followers my account was eligible for all these other features, such as going live and blue tick verification. 

Since the information was accurate – our account was just a few hundred followers short of 10k – I clicked on the link and entered my email and password to verify the account. Not long after I did that I realised all the posts had been wiped from the Instagram account. 

It was completely heart sinking. You work so long and so hard to build up social media pages and grow your following and everything had just gone.  

A fair bit of my business was coming from Instagram at this point, so the prospect of all of that disappearing was devastating. 

Soon, I noticed that an Instagram Story had been posted to the account, demanding a ransom to be paid in bitcoin in order to get our Snow Windows account back. 

There was never any question of paying it. Aside from not wanting to give into them, we didn’t have any idea how to get hold of bitcoin. 

We refused to pay the ransom and ignored the message, instead we spoke to Instagram and explained the issue. But suddenly and without warning the account was completely shut down.  

Huge amounts of our business came through Instagram and our big fear was that we’d never get the account back at all. In fact, we had to campaign to get it back, speaking to the BBC and featuring on Chris Moyles’ (a Snow Windows customer) radio show.  

Eventually the account was re-instated, and our log-in was reset. However, we started to notice things going wrong with our Facebook account – which was linked to our Instagram. 

Snow Windows has more than 200k followers on Facebook and the platform is a huge source of business for us, however even since the Instagram hack we’ve been unable to post any adverts onto our Facebook business page – an issue Meta, which owns Facebook and Instagram, has been unable to fix. 

Back in 2019 the Snow Windows Facebook page got 273 million organic interactions during October – December. So, more than three years on we can’t imagine how much growth and business we’ve missed out on as a result of this issue. 

Case study 2

“It’s something I see a lot of people in the business community talking about nowadays, and it’s something I really want people to consider.” Aiden Ryan of Loaf Manchester – who himself suffered a cyber attack – discusses the importance of raising cyber security awareness among the city’s small business community.  

With my cake and coffee brand, Loaf Mcr, I am an active a part of Manchester’s thriving small business community. The business grew during lockdown from making cakes to raise money for the NHS to supplying his bakes to Selfridges and 13 different cafes cross Manchester. 

Over the course of lockdown I began to notice that more fellow small business owners seemed to be falling victim to cyber attacks. Lots of businesses across Manchester were having their social media accounts hacked and I spotted that the small business community was rallying together to promote cyber security advice. 

In lockdown there seemed to be a heightened awareness of the importance of cyber security as a result of some prolific Manchester accounts in the food business sharing stories about being hacked. You'd often see Instagram Stories where you’d know the account had been compromised, or big social media accounts would share stories of businesses who’d been attacked, explaining they'd lost accounts and followers. That had a big impact. After that, I know that lots of businesses starting to use 2SV (2-Step Verification) and think about their cyber security. 

Before starting Loaf, my personal Twitter account was hacked and completely taken over, after a leak of log ins and email addresses was posted to a hacker sharing site. The hacker cleared all evidence of me off the account and changed my password and the account email address so I couldn’t get back in. 

Years later when I set up my business, I took this incident into account and prioritised my cyber security from the get-go. From the start I used 2-Step Verification on all my social media accounts and set up an entirely new email address.   

That was a lesson learned. When I set up the brand, I took cyber security steps immediately. It's one thing when it happens to your personal accounts where you speak to friends and family, and quite another when it’s a business account with following of 14 K and two to three years of work behind it. 

Often, people have paid money to grow those followings; they’ve spent on social media marketing tools, and agency advice. So, when something happens they lose the money they've invested as well as the future business. 

It’s something I see a lot of people in the business community talking about nowadays, and it’s something I really wants people to consider. 

I think ever since I started using 2SV, I felt more confident. I don't feel scared it's going to happen to me but I do know that you can always do more. 

Loaf was built through community. It was an underdog story - people want to see good things happen. Which is why I feel so passionate about this too; I want to help others in the business community recognise that this matters. Businesses are built through community and they thrive through community. 

Case study 3

“When something like this happens, as a small business you don’t know where to turn or what to do.” Leah Kelly of Malfie & Cro in Cwmbran in Wales, shares her experience of losing access to her business’ social media account.

It all started around May 2022. I was getting ready for my first craft fair, so I was posting lots on social media to get some traction and engagement.

Then one evening I went onto my Instagram account and a message flashed up saying I’d been logged out.

I tried to log in through the app on my phone, but it wasn’t happening. I reset the password but still couldn’t get back in.

I sent in an appeal and got a response a few hours later saying that there was suspicious activity on the account that looked to be coming from Moscow, and that as a result the account had been shut down. I started bawling straight away – this was how I made my money and I didn’t know how to get it back.

I was using Instagram as my main source of marketing, and once the account fell apart, I was completely lost.

I tried to get the account back for about two weeks, but eventually I needed to get back to my business. I made a new account to replace the old one and immediately had the problem that people thought it was a fake. Starting again from nothing was so infuriating.

I have worked hard on the new account, but I’ll always wonder how much further along my business might be if I’d not had to start my Instagram from scratch. Surely it will have affected my follower count and my turnover?

The account is still shut down, which is a silver lining in a way, because nobody can use it to scam people or ruin my brand’s reputation.

I’ve put a lot of effort into restoring my followings, but I’m always worried that it’ll slip through my fingers again. It has created a frustrating sense of anxiety, and I want to try and stop it from happening to other people.