Been Hacked? What to Do First
If you think your business has been hacked, the next hour matters. Work through these steps, and call for help early.
First steps
Disconnect, do not wipe
Take affected computers off the network, but leave them powered on if you can. Rebooting or wiping can destroy evidence of what happened.
Secure your accounts
From a device you know is clean, change passwords and turn on MFA, starting with email and admin accounts.
Protect your backups
Disconnect backups so they cannot be encrypted too. Do not delete logs or suspicious emails.
Write it all down
Note what you saw and when. Photograph any ransom notes or error messages.
Call your bank
If money moved or a payment was redirected, contact your bank right away. Speed can make recovery possible.
Do not pay or reply yet
Talk to your insurer, your attorney, and an incident responder before you pay a ransom or answer an attacker.
Who else to tell
Call your cyber insurance carrier, because many policies set their own rules for reporting and for which vendors you may use. Ask your attorney whether you need to notify customers or regulators, since some industries have firm deadlines. You can also report the incident to the FBI at ic3.gov.
How ShadowTech helps
Jonathan has spent over a decade on an enterprise security incident-response team. ShadowTech can help you contain the problem, find out what happened, recover, and document it in a written report. Read more about our cybersecurity services.