What To Do in the First Hour of a Cyberattack

Stay Calm. Act Fast.

A cyberattack is disorienting. Systems are behaving strangely, employees are panicking, and you don't know how bad it is yet. The steps you take in the first hour matter enormously.

This is not a technical guide — it's a guide for business owners. Print it out and keep it somewhere accessible.

Step 1: Stop the Spread (Minutes 1–10)

The most important thing you can do immediately is limit how far the attacker can move.

• Disconnect affected computers from the network (unplug the ethernet cable or turn off Wi-Fi)
• Do NOT turn the machines off — this can destroy forensic evidence
• If you suspect the attack is still in progress, consider temporarily taking your entire network offline by unplugging your router

Step 2: Preserve Evidence (Minutes 10–20)

Law enforcement, cyber insurance, and forensic investigators will need evidence. Don't wipe anything.

• Take photos of any ransom messages or unusual screens with your phone
• Write down a timeline of what happened and when you first noticed it
• Note which systems are affected and which appear normal

Step 3: Notify the Right People (Minutes 20–40)

• Your cyber insurance provider — call them immediately, they often have incident response resources included in your policy
• Your IT team or managed service provider (if you have one)
• A cybersecurity firm — this is where we come in. Contact us here for immediate triage guidance
• Legal counsel — especially if customer data may be involved, as breach notification laws may apply

Step 4: Assess What's Affected (Minutes 40–60)

With help from a technical resource, begin to understand:

• What data was potentially accessed or encrypted?
• Are backups intact and isolated from the affected systems?
• Is the attacker still active, or was this a one-time event?

What NOT to Do

• Don't pay the ransom without expert advice — payment doesn't guarantee recovery and may invite future attacks
• Don't try to fix it yourself if you're not technical — you may accidentally destroy the evidence or make recovery harder
• Don't announce it publicly until you understand what happened and have legal guidance

Get Help

If you're in the middle of an incident right now, go to our portal and use the Incident Response assistant. We'll walk you through immediate steps and connect you with our team.

If you want to prepare before something happens (the best time to plan is before a crisis), schedule a free consultation.