Think you've been hacked? What to do in the first hour

Maybe files suddenly won’t open and there’s a ransom note on the screen. Maybe customers are asking about strange emails that came from your account. Maybe money moved that nobody approved. Whatever it is, the first hour matters, and the right moves are simpler than you might think.

Take a breath. Then work through these steps in order.

1. Disconnect the affected computer, but don’t turn it off

Unplug its network cable and turn off its Wi-Fi. That cuts off the attacker and keeps the problem from spreading to other machines.

Leave it powered on. The Federal Trade Commission’s guidance for small businesses is specific about this: shutting down can destroy information investigators need to figure out what happened. If several computers look affected, disconnect each of them the same way.

2. Stop using the affected accounts to talk about it

If the attacker is in your email, they can read your messages about the attack. Switch to phone calls, or to an account you’re confident hasn’t been touched, until you know more.

3. Call for help, by phone

• Your IT person or IT company. Call; don’t email. Tell them what you saw and when.
• Your cyber insurance company, if you have a policy. Many policies expect you to involve their response team early, so call before you start fixing things yourself.
• Your bank, immediately, if any money or banking details are involved. The sooner they know, the better the chance of stopping a payment.

4. Change passwords, from a clean device

Change the passwords for any account you think was taken over, starting with email and banking. Do it from a device that wasn’t involved, like your phone or another computer. If you used the same password anywhere else, change it there too, and turn on two-step sign-in while you’re at it.

5. Don’t wipe, reinstall, or “clean up” yet

It’s tempting to restore everything right away, but wiping computers or deleting suspicious files can erase the evidence that shows how the attacker got in and what they took. Let whoever is investigating tell you when it’s safe to restore. Otherwise, the same hole may still be open next week.

6. Write down what you know

While it’s fresh, jot down what happened, when you first noticed, what was on the screen, who you’ve called, and what you’ve done so far. Take phone photos of any ransom notes or strange messages. This helps your IT help, your insurer, and law enforcement.

7. Report it

• Report cybercrime to the FBI through its Internet Crime Complaint Center at ic3.gov, or contact your local FBI field office.
• Government offices, police departments, and banks may also have reporting rules with their state agencies or regulators. Your IT provider or insurer can help you sort out which apply.
• If personal information about customers or employees was exposed, there may be legal notification requirements. The FTC’s data breach guide, linked below, is a good starting point, and it’s worth talking to a lawyer.

If it’s ransomware

If there’s a note demanding payment, don’t pay or respond before talking with your IT help, your insurer, and law enforcement. Paying doesn’t guarantee you’ll get your files back, and investigators may know of a free way to recover them. This is also the moment when good backups pay for themselves; see backups for a small office.

Before it happens: a one-page plan

Most small offices don’t have an incident plan, and they’re scrambling for phone numbers on the worst day of the year. Make a single page, print it, and keep a copy somewhere other than your computers. The free one-page incident response plan is ready to fill in, or cover at least these:

• Your IT person or company’s phone number, including after hours
• Your bank’s fraud number
• Your cyber insurance policy number and claims line
• Who in the office makes decisions during an incident
• Where your backups are and who can restore them

Sources

• Cybersecurity for small business (Federal Trade Commission): disconnecting infected devices without powering them down, changing compromised passwords, investigating, and reporting to the FBI
• Data breach response: a guide for business (Federal Trade Commission): securing systems, preserving evidence, and notifying affected people
• Reporting a cyber incident (CISA): reporting to CISA, the FBI, local law enforcement, and regulators