You need to report a hacked website to the ICO only if personal data was affected and the breach is likely to put people at risk. Many website hacks (spam pages, redirects, defacement) don't touch personal data at all. But if your site stores customer details, orders, form submissions or member accounts, you need to find out whether they were accessed, and decide within 72 hours of becoming aware.
What personal data might be on your website?
- Contact form submissions stored in the database
- Customer accounts, addresses and order history on a shop
- Newsletter subscriber lists
- Booking details, or uploaded documents
How to tell if it was accessed
Check server access logs for downloads of database exports or unusual requests, look for new admin users or files, and check whether payment details were ever stored on the site (they usually shouldn't be: most shops pass them straight to the payment provider).
If you're not sure
The ICO's self-assessment tool walks you through it. Record your decision and reasoning either way: you're expected to keep a log of breaches even if you don't report them.
We clean the site and establish what was accessed: data breach help and hacked website repair.
