A cyberattack can look pretty different depending on the method, your setup, and the threat actor's objective. People usually suspect one is happening when their device starts acting very strange, very quickly. It could be a screen that freezes, a ransom note that shows up, or an unfamiliar app you did not install.
The immediate response in the first hour after a security incident influences just how impactful this attack will be. SpireTech made a guide for employees and company leaders about what to do, in what order, and what not to do.
SpireTech Clients: Call Us Now, Don't Submit a Portal Ticket
If you're a SpireTech client and you suspect an attack, stop reading this and call us now at (503) 222-3086.
Please do not submit a ticket through the customer portal or email support for a suspected cyberattack. This isn't the time to use those methods to communicate. For an active security incident, call us. The incident won't waste time in triage and you will be helped more quickly. If you report this problem via your customer portal or email, the response time may be slower.
When you call:
- Tell us immediately that you think it's a cyberattack or security incident so we can prioritize it appropriately
- Report what you think you did that triggered the reaction (if you believe you did something to trigger it)
- Describe what you saw, like a pop-up, strange email, unexpected login alert, missing files, etc
- Tell us which device and account were involved
- Stay near the affected device so we can walk you through next steps
Even if you're not sure that it was an attack, call us anyway. We'll be able to assess whether or not it's a threat, and how urgent it is.
Not a SpireTech client? Book an IT Consultation with us to see if we'd be a good fit to help your company.
For everyone else, here's what you should do immediately once you suspect a cyberattack.
Minutes 1-10: Contain and Don't Investigate
Your first instinct may be to figure out what happened and investigate more on your computer. Don't. Instead of figuring out what happened, first contain the damage and stop it from spreading.
- Disconnect the device from the network. Unplug the Ethernet cable and turn off Wi-Fi. This is because an attacker who gets into one computer can use it as entry point to reach other devices on the same network, such as other workstations, your file server, shared drives, and anything else that the computer can "talk" to. The jump to other devices during a security incident is called lateral movement and is exactly how ransomware spreads from one machine to the whole office. Cutting the network connection takes away that path and keeps one compromised computer from compromising the whole office.
- Don't turn the computer off, unless you can't disconnect it from the network otherwise. Shutting down the computer could erase evidence stored in memory that can help responders understand what happened. The guidance from CISA (Cybersecurity and Infrastructure Security Agency) is to isolate affected systems first and leave devices on. The exception is if you can't get the device off the network. In that case, power it down to keep the infection from spreading. Otherwise, leave it on unless your IT team advises something else.
- Don't delete anything. Whether it was a suspicious email, ransom note, or weird file, leave it so it's preserved as evidence.
- Don't pay, reply, or negotiate. If there's a ransom demand, don't engage. The FBI and CISA do not recommend paying ransoms because payment does not guarantee you'll get your data back. It also encourages attackers to keep going. Any response to the demand is a decision for your leadership team, legal counsel, insurer, and your IT and security partners to make. Do not handle it by yourself.
Minutes 10-30: Use a Safe Line and Notify the Right People
If an attacker has access to your email or network, they may be able to see your communications. Use out-of-band communication: a phone call or text from a device that wasn't affected when reporting the incident. If the attacker gained access to your email account on one device, assume that they have access to your email account on other devices.
Who to inform first:
- Your IT provider or internal IT team. They should be the very first call so they can start and internal processes that have been mapped out already.
- Your manager or company leadership. The heads of your companies need to know as soon as possible to make decisions about operations, clients, and legal obligations.
- Your bank, if money moved or might move. If you think a fraudulent wire or payment went out, call your bank immediately and ask them to contact the receiving bank about recalling the transfer. Speed matters for any chance of getting funds back
For future reference, our guide on how to spot and report phishing attacks covers the warning signs of email phishing to share with your team.
Minutes 30-60: Secure Accounts and Document Everything
Once the affected device is isolated and the right people have been contacted, your IT team will start working on containment.
Change passwords from a clean device
If you entered your credentials somewhere suspicious, change that password right away, and do it from a device that wasn't involved. Your IT team may also force sign-outs across all sessions and review multi-factor authentication settings.
Write down what happened
While the incident is still fresh in your memory, document:
- What you saw, and when
- What you clicked, opened, or downloaded
- Any messages, pop-ups, or phone calls connected to the event
- Which accounts or systems you used afterward
Start thinking about legal obligations
Depending on your industry and the data involved, the company may have notification requirements to clients, regulators, or insurers. Check your cyber insurance policy, because many carriers want to be notified early and may have approved response vendors. For fraud and cybercrime, the FBI's Internet Crime Complaint Center (IC3) is the central hub for reporting, and the FBI says reports can help it investigate and, in some cases, freeze stolen funds. For ransomware, CISA and the FBI also encourage victims to report to their local FBI field office or directly to CISA.
Why the First Hour After a Cyberattack Matters
The stakes of a cyberattack or security incident aren't just one computer or one password to change. Threat actors rarely stop at one computer. Breaches can go undetected for months, and the longer an intruder has access, the more difficult fixing it becomes.
We broke down those numbers in the cost of a data breach to explain the monetary stakes of a security incident.
Recovery also depends on what preparations were completed before the attack. Having clean and tested backups allows a company to restore data instead of negotiating it out of ransom. One common backup strategy is the 3-2-1 backup rule. A good start is pairing data backup with a real recovery plan.
Build Your Security Incident Plan Before You Need It
The worst time to figure out what to do after a cyberattack is during. As a starting point, here are a few things every business should have:
- A printed one-page incident response sheet with phone numbers (so it's not just stored on the network that might be down)
- A clear rule of where suspected incidents are initially flagged
- Regular security awareness training so employees recognize trouble early and stay educated on new tactics
- Monitored endpoints and email security through a cybersecurity partner who can respond around the clock
- Backups that are tested and not just made
If you're not sure about where to begin, we can help. Our managed IT services include security monitoring, backups, and a team that picks up the phone when it matters most.
Frequently Asked Questions
Q: Should I turn off my computer if I think it's been hacked?
A: Avoid turning off your computer even if you think it's been hacked. That can erase evidence in computer memory that could help responders figure out what happened and how far it spread. Disconnect it from the network by unplugging the Ethernet cable and turning off Wi-Fi, but leave it powered on. If you can't get it off the network, however, CISA's guidance is to shut it down to stop the spread.
Q: What if it turns out to be a false alarm?
A: A false alarm is the best possible outcome of a suspected security incident. Report it anyway.
Q: Should we pay the ransom? A: Don't make that call on your own, and don't reply to the attacker. The FBI and CISA don't recommend paying, because paying does not guarantee you'll get your data back, and it can mark you as a willing target. Bring in company leadership, legal counsel, your insurer, and your IT and security partners before any decision is made.
Q: Do we have to report a cyberattack to anyone outside the company?
A: Yes, depending on your industry and the data involved, you may have obligations to clients, regulators, or your cyber insurance carrier. Fraud and cybercrime can be reported to the FBI's Internet Crime Complaint Center (IC3) and ransomware can also be reported to your local FBI field office or CISA. If money was involved, contact your bank immediately.