Most of the toolkit is about prevention. This guide is the other half: what to do when prevention has failed and something has gone wrong. Because the difference between a scare and a disaster is almost entirely about how fast and how calmly you react in the first hour.
Keep this one somewhere you can find it under pressure, because the moment you need it is exactly the moment your head is least clear. Print it, save it, put it in the staff handbook. When something happens, you do not want to be inventing the response from scratch.
You cannot react to something you have not noticed. The common signs that a nursery has been compromised:
You or a member of staff clicked a link and entered a password on a page you are now unsure about. Colleagues or parents report odd emails apparently from you. You are suddenly locked out of an account that worked yesterday. Your email is sending things you did not write, or rules have appeared that quietly forward or delete your messages. Money has moved, or a supplier says they were told your bank details changed when they weren’t. A computer is behaving strangely, running slowly, or showing a message demanding payment to unlock your files.
Any of these is enough to act on. You do not need to be certain it is an attack. It is far better to treat a false alarm seriously than to wave away the real thing.
Speed matters more than perfection here. Work through this in order.
Change the password on the affected account immediately, from a device you trust. If you cannot get in because you are locked out, contact whoever runs your IT straight away to regain control. If the same password was used anywhere else, and we hope after reading the passwords guide it wasn’t, change it everywhere it was used.
Sign out every session and turn on 2FA if it is not already on. Microsoft 365 lets you sign the account out everywhere at once, which kicks the attacker out even if they still have the password. Adding 2FA then stops them straight back in.
Tell your IT supplier now, not later. This is what they are for. The sooner they are looking, the sooner they can see what was accessed, lock things down, and check whether the problem has spread to other accounts. If Octopus 365 looks after your systems, this is a call-us-immediately situation, no apology needed.
Check your email for sneaky rules. A favourite attacker trick is to set up a rule that forwards or hides your incoming mail so they keep control quietly even after you change the password. Your IT supplier will check this, but it is worth knowing it exists.
If money is involved, call your bank, on a number from your card or their official site, not from any email. Fast contact gives the best chance of stopping or recovering a payment.
Once the immediate fire is out, the next job is working out how far it spread and what was exposed.
Was it just one account, or did the attacker reach others? Did they get to anything containing personal data, children’s records, parent details, staff information? What devices were involved, and do any need checking or wiping? Your IT supplier leads this, but you know your setting and your data, so it is a joint job.
If a device is showing a ransom demand, do not pay and do not keep using it. Disconnect it from the network, leave it alone, and get expert help. Paying rarely gets your data back and marks you as someone who pays.
This is the part that makes a nursery breach different from a corner shop’s, so it gets its own section.
If personal data has, or may have, been exposed, you have legal duties under GDPR. As a rule of thumb, if a breach is likely to be a risk to people’s rights, and children’s data almost always is, you must report it to the Information Commissioner’s Office within 72 hours of becoming aware of it. In some cases you must also tell the affected parents.
This sounds frightening but the regulator’s posture is far kinder to a nursery that reports promptly, honestly and with a clear account of what it did, than to one that hides a breach and is found out later. Speed and honesty work in your favour. If you are unsure whether something is reportable, the safe move is to treat it as if it might be and take advice quickly. The ICO website has clear guidance, and your IT supplier can help you understand what was actually exposed.
When the dust settles, spend twenty minutes on the bit everyone skips. How did they get in? A clicked link, a reused password, an account that should have been closed when someone left? Whatever the route, that is the gap to close so the same thing cannot happen twice. A breach is a horrible way to find your weak point, but having paid the price, it would be a waste not to fix it.
Write down what happened and what you did. That record helps if questions come later, and it makes you calmer and faster if there is ever a next time.
When something goes wrong, fast and calm beats clever. Change the password, sign out everywhere, turn on 2FA, and call your IT supplier, in that order, within the first hour. Remember the 72-hour clock if children’s or parents’ data may have been exposed, and that reporting promptly protects you. And make it utterly safe for staff to raise the alarm the instant they suspect something, because the fastest reports come from people who are not afraid of getting into trouble.
This guide covers the practical steps, not legal advice, and every breach is different, so take professional guidance on your specific situation. Octopus 365 has supported nurseries since 2011, and James has worked with early years settings since 2009. If the worst happens, or you’d like to talk through your response plan before it does, you’ll find us at the Summit, or get in touch any time. No hard sell, just a converstaion.