Disruption can be the main harm
Healthcare, transport, retail, government and payment services can become unavailable even when no public evidence shows that customer data was taken.
Public systems and disruption
Cyberattacks and ransomware: what the public needs to know
Cyberattacks are attacks on systems, services or data. Ransomware is one form of cyberattack that may encrypt systems, steal data, disrupt services and demand payment. The public impact depends on what was affected, so an outage alone does not prove that personal information was stolen.
Page T-002Guidance pageReviewed 29 August 2026
Key Guidance
An outage does not prove a cyberattack, and a cyberattack does not automatically prove that personal data was stolen. Look for the organisation’s confirmed description of the incident before deciding what it means for you.
Start with Key Guidance for the short answer. Then read the sections that match what happened and what you need to do.
Understand the issue
Why this matters to you
People often see the effect first. A service stops, appointments are delayed, payments fail or an organisation warns customers. It may take longer to confirm the cause and what it means for you.
Ransomware may include data theft
Modern extortion can combine encryption with a threat to publish stolen information. Either element may occur without the other.
Early reports are incomplete
Initial statements often confirm an incident before the route, attacker, affected systems or full effects are known.
Confusion creates scam opportunities
Criminals may invent alternative payment routes, urgent support, refunds, security checks or priority access while normal services are disrupted.
Consequences and movement
What may happen next
A cyber incident can affect people in several ways. Check each effect separately instead of assuming the worst.
A service becomes unavailable
Users may need a verified temporary route, but false workarounds can appear alongside official updates.
Customer information is confirmed exposed
The incident then also becomes a data-breach question, with action based on the information involved.
Attackers publish or sell data
The exposure may support targeted phishing, account intrusion, identity misuse or pressure against the organisation.
Public attention outlives the incident
Even people who were not affected can receive messages that exploit the organisation’s name and the credibility of a real event.
Practical response
What you should do
You do not need to diagnose the attack. Use contact details you trust, separate confirmed facts from rumours, and act on any harm that affects you.
- Check official service informationUse the organisation’s known website, app or status page. Avoid links offered in posts, forwarded messages or unsolicited support contact.
- Do not invent the causeDescribe a service as disrupted until reliable evidence confirms ransomware, data theft or another cause.
- Reject unverified workaroundsDo not move a payment, booking, appointment or account process to a new route only because someone says the normal system is down.
- Follow a direct notificationIf the organisation confirms that your account or data is involved, apply the specific password, account, identity or financial actions it supports.
- Preserve evidence of follow-up contactKeep messages, numbers, payment instructions and screenshots if someone uses the incident to approach you.
- Escalate actual loss or accessContact the relevant bank, service or employer at once, then use the appropriate national reporting route.
Look more closely
Service disruption makes unfamiliar alternatives feel reasonable
When a familiar service fails, people naturally look for another way to continue. Criminals can exploit that disruption with convincing updates, support offers or payment instructions, so any workaround should be found and checked independently.
The outage, warning or headline creates attention.
Access, urgency, continuity or fear of loss creates pressure.
The attacker appears to be support, the provider, a supplier or an authority.
A new link, account, phone number or payment route is presented as necessary.
Selected history
Historical cases and lasting lessons
WannaCry and the NHS
WannaCry spread across many countries and affected 48 NHS trusts, disrupting care as well as computers.
Lasting lesson: The public effect of ransomware is not only stolen information or a ransom demand. It can be the loss of an essential service.
Health Service Executive, Ireland
A ransomware attack disrupted healthcare systems and clinical services, including access to appointment data.
Lasting lesson: Operational impact can reach ordinary people at once, while technical investigation and data questions continue in parallel.
Transferable understanding
Patterns over time
Attack, breach and outage are not synonyms
They may overlap, but each describes a different fact that should be confirmed separately.
Alternative routes are high-risk moments
A workaround deserves independent confirmation precisely because normal controls may be unavailable.
Incident language changes over time
Responsible reporting should update confirmed facts without treating early uncertainty as contradiction or concealment.
The public event can become a reusable Mask
Scammers may refer to the incident after systems recover because the story remains recognisable.
Plain-language answers
Common questions
Does ransomware always encrypt files?
No. Ransomware operations may encrypt, steal or delete data, disrupt systems, threaten publication or combine several methods.
Should I change my password after any cyberattack?
Only when your account or sign-in details may be involved, the organisation advises it, or you see suspicious activity. A general outage alone is not a reason to change unrelated passwords.
Is a service outage evidence that hackers have my data?
No. Outages have many causes. Wait for reliable confirmation of a breach and the affected data.
How do I use an emergency workaround safely?
Find it through a route you already trust and confirm the destination, request and payment details independently before acting.
If an incident affects you directly
Follow the affected organisation’s confirmed instructions. If you lose money or account access, contact the provider at once. Organisations experiencing an attack should use specialist incident-response guidance rather than relying on public commentary.
Scamology Insights
Recognise how disruption can redirect behaviour
These apps, tools, books and courses can help you notice when someone uses a real disruption to create urgency, claim authority or direct you to a contact or payment method you have not confirmed. Links are intentionally withheld in this production version.
Continue understanding
Explore related guidance
Evidence and currency