The difference between an incident that costs you a day and one that costs you a quarter is usually decided in the first hour, before any specialist arrives. What you do — and just as importantly, what you avoid doing — in those early minutes shapes everything that follows. Print this, put it somewhere everyone can reach it, and adapt it to your business.
Do not turn the machine off
The instinct is to shut down the affected computer. Resist it. Powering off destroys evidence in memory that tells responders what the attacker did and whether they are still active. Instead, disconnect it from the network — pull the cable or disable Wi-Fi — so it can no longer talk to anything while staying alive for analysis.
Contain before you clean
The goal in the first hour is to stop the spread, not to fix everything. Isolate affected systems, disable compromised accounts, and cut off the path the attacker is using. Cleaning up too early — deleting files, reimaging machines — often erases the very evidence you need to understand the scope and to be sure they are actually gone.
Write down what you see, with times
Start a simple log the moment you notice something wrong: what you saw, when, and what you did in response. Times matter enormously later — for your responders, your insurer, and any regulator. Screenshots of ransom notes, strange emails, or unusual account activity are worth more than a description from memory.
Assume the account is compromised, and the ones near it
If one set of credentials was stolen, treat every account that person could reach as suspect. Reset passwords, revoke active sessions, and turn on multi-factor authentication everywhere it is not already. Attackers move sideways; the first account is rarely the last.
Decide who speaks, and say nothing else yet
Name one person to handle communication. Staff should not email customers, post on social media, or speculate in group chats — early guesses are usually wrong and hard to walk back. You will communicate, but from facts, once you have them.
Then make the calls, in order
- Your incident responder or security partner. The sooner a specialist is engaged, the more of the trail survives.
- Your bank, immediately, if any money moved or payment systems are involved.
- Leadership, so decisions about downtime and disclosure are made by the people accountable for them.
- Legal and, where required, the regulator. Data-protection rules increasingly set a clock on reporting; know yours before you need it.
The real lesson comes before the incident
Every point above is easier if it was decided in advance. Who to call, where the log lives, who speaks — a one-page plan agreed on a quiet afternoon is worth more than the best improvisation under pressure. If you do not have one, that is the thing to fix this week, and it is something we can help you write in an afternoon.
If you are in the middle of an incident right now, stop reading and call our 24/7 response line. Everything above still applies — but you should not be facing it alone.