CYBERATTACKHAVE A BACKUP.

Your phone has signal, but your bank will not load. The grocery shop cannot take card payments. A familiar-looking message says you must reset your account immediately. Meanwhile, the online copies of your household documents are unavailable. The disruption could result from a cyber incident, a provider outage, ordinary technical failure or several problems at once. You may not know the cause while you still have decisions to make.

This guide is for anyone who wants the option of managing daily essentials if a cyberattack disrupts the services they depend on. It is not a prediction that an AI takeover or national cyber crisis will occur, nor a request that everybody stockpile. The practical aim is narrower: identify what stops working when trusted digital services fail, choose lawful alternatives and protect yourself from opportunistic fraud.

The UK's National Cyber Security Centre (NCSC) describes the importance of tested backups and documented service dependencies for organisations facing disruptive attacks. At household level, the same logic becomes an everyday question: which essential tasks can you complete without your usual app, inbox, website or connected device?

What does household cyberattack preparedness actually cover?

Cyber preparation is not simply installing antivirus software. Those protections help reduce the chance of account compromise, but they do not guarantee that a payment provider, pharmacy, phone network or public service will remain available. The household challenge is continuity: being able to obtain information, contact people and handle essentials when one or more digital routes stop working.

For an example, imagine a payment processor goes offline. Your accounts may be safe and your bank balance may be unaffected, yet a shop could still refuse electronic payment. Imagine instead that your email is compromised. The wider internet may work, but recovery links for many accounts may now be controlled by somebody else. These situations need different responses.

A single service failure is not evidence of an AI attack. Investigate through reliable channels rather than forwarding an unverified explanation. For techniques on checking alarming claims, see our fake emergency alerts guide.

Start with a dependency map, not a shopping list

Choose five real activities your household must be able to perform: communicate with a dependent relative, obtain medication, pay for necessities, access identity information and keep the home safe. Work backwards from each activity to the services it uses. For example, collecting a prescription might require a phone, access to a pharmacist, a medicine record and transport—not merely a working internet connection.

Draw three columns on paper: task, normal route, fallback route. If your fallback depends on the same internet connection or sign-in as the normal route, it is not independent. You may discover that several seemingly separate services all depend on one phone, email address or cloud account.

Make the fallback realistic for your location and circumstances. A shop may not accept cash during an outage, an alternate bank may use the same infrastructure, and a neighbour might be away. Test the assumptions gently rather than declaring a method guaranteed.

Build a small, protected offline information pack

Even a basic paper pack can resolve the frustrating problem of not knowing a telephone number because it is stored only in a locked phone. Include names and numbers for people you might need to contact, your electricity network operator, the place you obtain prescriptions and the trusted routes for reporting suspected banking fraud.

It can also help to have a list of essential service providers, device model numbers, policy references and medical contact details where necessary. Do not create a loose document containing every password, full card number, identity document and recovery secret. Put sensitive records in a secure, access-controlled location. For digital copies, use properly encrypted storage with a separate recovery process.

The British Red Cross's October 2026 emergency-kit guidance includes printed contact information, useful documents, a radio and an independently powered light. You can adapt that to what you actually use without turning an ordinary cupboard into an elaborate bunker.

Choose independent ways to communicate

Messages sent through different apps may still depend on the same phone and data connection. A charged phone is useful, but it is only one part of a communication plan. Write down key numbers, agree how relatives would check in if messaging stopped, and identify a local place where official information is normally posted.

If one network is unavailable, another operator or landline may sometimes work, but do not assume that during a widespread outage. Digital home phones may also lose service when their router loses power. The Met Office advises people whose digital landline is critical and who have poor mobile signal to discuss alternative arrangements with their communications provider.

For an ongoing local emergency, a battery radio can provide broadcasts when your usual screen is unavailable. Learn which stations carry local updates before you rely on them. Different countries have different emergency alerting systems; use verified local sources rather than a forwarded screenshot.

Make account recovery possible without your usual phone or inbox

Many accounts use the main email inbox or phone to recover passwords. If that single point of access is unavailable, losing control of one service can cascade into others. Review recovery options for your email, password manager, banking and cloud storage through the genuine provider's security settings.

The NCSC's account-recovery guidance recommends keeping backup credentials and recovery information where they remain accessible even if the main email account is lost. The exact steps vary by provider. Some require an authenticator, a trusted device or printed one-time codes, so verify the method before you need it.

Store recovery secrets securely; a sealed paper copy kept somewhere private may be appropriate for some households, but it must not be available to casual visitors. An alternate email account should be independently protected rather than sharing the same reused password. For prevention and sign-in checks, refer to our home cybersecurity guide.

How much cash or physical supplies make sense?

There is no universal amount. A small cash fallback can be useful if electronic payments fail and local traders continue accepting cash, but carrying large sums adds theft and loss risk. Base your choice on typical small purchases, the number of people in the household and where the money can be stored safely. Don't assume every shop will open or be able to make a sale.

Similarly, some ready-to-eat food, drinking water and essential toiletries can reduce dependence on a single shopping trip. Choose ordinary supplies you already use and rotate them normally. If storage or finances are limited, prioritise essentials rather than buying equipment to meet somebody else's arbitrary list.

The idea is to preserve options, not to prove a prediction about cyber warfare or artificial intelligence. If payment systems fail but water and electricity remain available, your useful alternatives are different from those needed during a winter blackout. Read our prolonged power outage guide for the latter situation.

Respond differently to a service outage and an account compromise

If a bank's app is down but your account has not been compromised, avoid repeatedly entering credentials on unfamiliar 'backup banking' sites. Verify the situation through the bank's known public status page or independently obtained telephone number. Record any urgent transaction issue and use another legitimate payment route if available.

If you see unauthorised transactions, suspicious logins, unknown forwarding rules or unexpected changes to your account, treat that as a possible compromise. Contact the bank immediately where money is at risk, recover accounts using a trusted device and keep evidence. Our first-60-minutes data breach guide covers the response decisions in greater depth.

When online communication is disrupted, scams may exploit confusion. A convincing voice or message asking you to 'verify your account before service returns' is not evidence that the sender is authorised. Never disclose a one-time sign-in code to an unexpected caller. An urgent demand for a payment or credential is a reason to check independently.

What if a cyber incident affects several services together?

Some providers share cloud infrastructure, telecommunications links or outsourced service processors. A disruption in one part of that chain may produce failures that look unrelated. The NCSC's October 2026 resilience guidance emphasises documenting technical dependencies because restoring one system may not restore the service people actually need.

For a household, ask whether electricity, communications, payments and heating are all affected or whether the problem is confined to one account. A wider outage may change priorities from digital recovery to physical safety, particularly for people who depend on powered medical equipment. A cyberattack could be one possible cause, but it should not be asserted without evidence.

A 30-minute household continuity exercise

1. Minutes 0–5: List five activities that would become difficult if the internet stopped.
2. Minutes 5–10: Find the phone numbers and provider information needed for those activities without searching online.
3. Minutes 10–15: Check whether your essential documents are independently available, without exposing them in a shared folder.
4. Minutes 15–20: Review the legitimate recovery method for your main email and check where its backup codes are stored.
5. Minutes 20–25: Identify how you would receive local updates with a discharged phone or failed Wi-Fi connection.
6. Minutes 25–30: Note two assumptions that failed. Fix only those gaps, then repeat the exercise another day.

This should be a tabletop exercise, not a deliberate disconnection of a person's essential care equipment, a live payment-system test or a destructive change to account permissions. If somebody in the home needs continuous clinical support, plan directly with their equipment supplier and care team.

How this relates to possible future AI loss of control

Some people are concerned that increasingly autonomous AI could affect infrastructure, cyber operations and the reliability of digital services. Nobody can provide a certain timetable or guarantee that such scenarios will or will not occur. A household continuity plan need not rest on resolving that debate. It simply gives readers who are concerned a way to assess which everyday dependencies they would want to reduce.

One useful next step is to test an independent information route: can you contact an essential person and find an authoritative source without your usual social app? That outcome is measurable, unlike a prediction about a global AI takeover. For the broader scenarios and uncertainties, see our analysis of AI takeover pathways.

Frequently asked questions

How should I prepare for a cyberattack at home?

Identify essential digital dependencies, secure important accounts, maintain separate backups, and plan how you would contact people or obtain necessities if your usual services failed. Tailor those steps to what your household actually needs.

Does a banking app outage mean I have been hacked?

No. Service maintenance, ordinary technical failures and wider provider incidents can also cause an outage. Check independently for unauthorised transactions or logins before concluding that an account is compromised.

Should I keep passwords on paper?

A printed or written recovery method can be useful in some circumstances, but protect it like any other sensitive credential. Do not leave a comprehensive password list or one-time codes where unauthorised people can find them.

Will a second mobile network always work in a cyber crisis?

No. Providers may share dependencies or be affected by a wider power or communications problem. An alternate route can increase options without guaranteeing continuity.

Research and further reading

• NCSC — technical recovery and dependencies, October 2026.
• NCSC — protecting administrator and recovery accounts.
• British Red Cross — emergency kit and communication alternatives, October 2026.
• NCSC — responding to a household cyber incident.