A cyberattack can place an entire business under pressure within minutes. Employees may be unable to access files, customers may begin reporting suspicious messages, computers may display ransom demands, or company data may appear for sale online.
The decisions made during the first 24 hours can determine how far the attack spreads, how quickly the business recovers, and how much financial and reputational damage occurs.
This is not the time for employees to experiment with fixes, negotiate with criminals, or restore systems without understanding what happened. The company needs to activate its incident response plan, contain the threat, preserve evidence, and coordinate its technical, legal, insurance, operational, and communication responses.
The following guide outlines the actions a business should consider during the critical first day of a cyberattack.
Quick Answer: What Should a Business Do After Discovering a Cyberattack?
During the first 24 hours of a suspected cyberattack, a business should:
- Confirm that something unusual is occurring.
- Activate its cybersecurity incident response plan.
- Contact its IT provider or incident response team.
- Isolate affected devices and accounts.
- Preserve logs, messages, and other evidence.
- Determine which systems and data may be affected.
- Notify executive leadership, legal counsel, and the cyber insurance carrier.
- Protect backups and critical business systems.
- Control internal and external communications.
- Report criminal activity to the appropriate authorities.
- Begin a carefully managed recovery process.
- Document every important action and decision.
The exact response will depend on the nature of the attack. A stolen email password requires a different technical response than ransomware spreading across a network. However, the priorities remain consistent: protect people, contain the incident, preserve evidence, understand the scope, and restore operations safely.
The National Institute of Standards and Technology organizes modern incident response around detecting, responding to, and recovering from cybersecurity incidents, with continuous improvement connecting those activities. NIST’s current incident-response guidance also emphasizes that preparation, governance, asset identification, and protective safeguards support an organization throughout the response process.
The First 15 Minutes: Verify, Escalate, and Avoid Making the Situation Worse
The first person to notice a cyberattack may not be an IT professional. It could be an employee who cannot open a file, an accountant who sees an unusual wire-transfer request, or a customer who receives a suspicious email from a company account.
That person should know exactly how to report the problem.
Recognize the Possible Warning Signs
Common indications of a cyberattack include:
- Files that are unexpectedly encrypted, renamed, or unavailable
- A ransom note displayed on a computer
- Unrecognized multifactor authentication requests
- Passwords that suddenly stop working
- Suspicious emails sent from an employee’s account
- Unauthorized financial transactions
- New administrator accounts
- Security alerts from antivirus or endpoint protection software
- Unusual network activity
- Computers running slowly or restarting unexpectedly
- Missing, altered, or deleted business data
- Customers reporting fraudulent messages
- Unexpected changes to website content
- Employees being redirected to unfamiliar login pages
One warning sign does not always confirm a cyberattack, but it should be investigated immediately.
Activate the Incident Response Plan
Once the incident appears credible, the business should activate its incident response plan. This plan should identify who has the authority to declare an incident and who must be contacted.
The initial response team may include:
- Internal IT personnel
- The company’s managed IT or cybersecurity provider
- Executive leadership
- Legal counsel
- The cyber insurance carrier
- Human resources
- Finance
- Operations
- Communications or public relations
- An outside digital forensics firm
One person should be placed in charge of coordinating the response. This prevents different teams from taking conflicting actions or assuming someone else is handling an important task.
Do Not Attempt Random Fixes
Well-intentioned employees can accidentally make an incident more difficult to investigate. They may delete suspicious files, restart computers, wipe devices, restore backups, or communicate with an attacker before the response team understands the situation.
Unless there is an immediate safety or operational reason to act, employees should avoid:
- Deleting ransom notes or suspicious emails
- Reinstalling operating systems
- Running unapproved cleanup software
- Resetting every account at once
- Restoring files over potentially valuable evidence
- Connecting backup drives
- Contacting the attacker
- Posting details on social media
- Discussing the incident through a compromised email system
Employees should report what they observed and follow instructions from qualified responders.
The First Hour: Contain the Threat
Containment is one of the most important priorities during the first hour. The objective is to prevent the attacker from reaching additional devices, accounts, data, or backup systems.
Isolate Affected Devices
A suspected computer, server, or mobile device may need to be disconnected from the network. This could involve:
- Unplugging its Ethernet cable
- Disabling Wi-Fi and Bluetooth
- Removing the device from a network segment
- Blocking its connection through security tools
- Isolating the endpoint through an endpoint detection and response platform
Isolation is different from immediately powering off the device. Turning off a computer can destroy information stored in active memory that may help investigators understand the attack. On the other hand, leaving an actively encrypting or destructive system running can cause additional damage.
Because the correct action depends on the circumstances, businesses should obtain direction from their incident response or cybersecurity team whenever possible. If immediate containment is necessary, document exactly what was disconnected, when it occurred, who performed the action, and why.
Disable Compromised Accounts and Sessions
If an email, cloud, administrator, or employee account appears compromised, responders may need to:
- Disable the account temporarily
- Revoke active login sessions
- Reset the password from a known-clean device
- Require multifactor authentication
- Remove unauthorized authentication methods
- Review recent sign-ins
- Check mailbox forwarding rules
- Revoke suspicious application permissions
- Rotate exposed API keys or access tokens
- Examine changes to administrative privileges
Changing a password alone may not remove an attacker. A criminal may still have an active session, stolen token, malicious forwarding rule, or another compromised administrator account.
Segment Critical Systems
Responders may need to temporarily separate affected parts of the network. This can prevent an attacker from moving laterally between workstations, servers, cloud services, and backup systems.
Critical infrastructure should receive immediate attention, including:
- Identity and authentication systems
- Domain controllers
- Email platforms
- Financial applications
- Customer databases
- Electronic health record systems
- Operational technology
- Remote access tools
- Cloud management accounts
- Backup systems
The response team should avoid disconnecting the entire company without evaluating the potential consequences. A broad shutdown could interrupt safety-related systems, destroy visibility, or cause unnecessary business disruption.
Containment decisions should balance urgency, evidence preservation, safety, and operational impact.
Hours 1–4: Preserve Evidence and Determine What Happened
After immediate containment begins, the business needs to understand the nature and scope of the incident.
Start an Incident Log
Every important action should be documented from the beginning.
The log should record:
- When suspicious activity was first noticed
- Who reported it
- What the person observed
- Which systems and accounts may be involved
- Security alerts and error messages
- Screenshots of ransom notes or suspicious activity
- Containment actions
- Password or permission changes
- People contacted
- Decisions made
- Times systems were disconnected or restored
- Communications received from attackers
- Known effects on customers and operations
Use a communication and documentation method that is not dependent on the potentially compromised environment. If company email may be affected, the response team may need an approved alternative communication channel.
Preserve Digital Evidence
Digital evidence can help investigators determine how the attacker entered, what the attacker accessed, and whether information was stolen.
Potential evidence includes:
- Firewall and network logs
- Authentication records
- Cloud activity logs
- Endpoint detection alerts
- Email headers
- Suspicious messages and attachments
- Malware samples
- Ransom notes
- User activity records
- Server logs
- Virtual machine snapshots
- Security camera records
- Copies of affected systems
- Records of unauthorized transactions
- Communications with the attacker
Evidence should be collected and stored in a controlled manner. Investigators may need to document who collected it, when it was collected, where it was stored, and who accessed it.
NIST guidance treats incident response as an integrated cybersecurity risk-management activity and stresses the importance of coordinated detection, response, recovery, and improvement. Its Incident Response Recommendations and Considerations for Cybersecurity Risk Management can help organizations develop a more structured response capability.
Establish the Initial Scope
The business may not understand the full impact during the first few hours. The response team should develop an initial assessment by asking:
- What type of attack appears to have occurred?
- Which systems, accounts, and locations are affected?
- When did the suspicious activity begin?
- Is the attacker still active?
- How did the attacker gain access?
- Did the attacker obtain administrator privileges?
- Was malware installed?
- Were files encrypted, altered, or deleted?
- Was information viewed or removed?
- Which customers, employees, or vendors may be affected?
- Are backups still available and trustworthy?
- Are critical operations safe?
- Is the incident continuing to spread?
The team should clearly distinguish confirmed facts from assumptions. Early reports are often incomplete, and inaccurate information can lead to poor decisions or misleading public statements.
Hours 2–6: Contact the Right Outside Parties
A business should not wait until it understands every detail before contacting the professionals who will help manage the incident.
Notify the Cyber Insurance Carrier
If the company has cyber insurance, it should review the policy and notify the carrier promptly.
Many policies have specific reporting requirements. The insurer may require the company to use approved:
- Breach counsel
- Digital forensic investigators
- Ransomware negotiators
- Data recovery providers
- Public relations consultants
- Notification services
- Credit-monitoring providers
Hiring a vendor without first consulting the carrier could affect coverage. The company should document when the insurer was contacted and what instructions it provided.
Contact Legal Counsel
Cyber incidents can create legal obligations involving privacy, contracts, employees, regulators, customers, and law enforcement.
Qualified legal counsel can help the business:
- Determine which notification requirements may apply
- Coordinate the investigation
- Preserve confidentiality where legally appropriate
- Review contractual obligations
- Communicate with insurers and regulators
- Evaluate ransomware-related legal concerns
- Prepare accurate customer and public communications
Notification deadlines vary by jurisdiction, industry, contract, and type of information involved. The company should not assume that every incident has the same requirements.
Report Criminal Activity
Cyberattacks involving ransomware, fraud, extortion, stolen funds, or unauthorized network access may need to be reported to law enforcement.
Ransomware victims can contact a local FBI field office or submit a report through the FBI’s Internet Crime Complaint Center at IC3.gov. The FBI’s ransomware guidance encourages reporting and states that it does not support paying a ransom because payment does not guarantee the recovery of data and encourages further criminal activity.
Businesses may also report certain incidents to the Cybersecurity and Infrastructure Security Agency. Legal counsel and the incident response team can help determine which reporting options and obligations apply.
If money was transferred fraudulently, the company should contact its financial institution immediately. Rapid action may improve the possibility of freezing or recovering funds.
Notify Important Technology Providers
The incident may involve a cloud platform, payment processor, email provider, software vendor, or other third party. These providers may have information or controls that the business cannot access independently.
Before contacting a vendor, confirm the appropriate security or incident-response channel. Avoid sending sensitive details to a general support inbox if a secure reporting method is available.
Hours 4–12: Protect Backups and Maintain Essential Operations
Once containment and investigation are underway, the company must protect its ability to recover.
Secure the Backups
Attackers frequently target backups because usable backups reduce their leverage. The response team should determine:
- Whether backups are isolated from the affected network
- When the last successful backup occurred
- Whether backup administrator accounts were compromised
- Whether backup files were changed, encrypted, or deleted
- Whether offline or immutable copies are available
- Whether the backups can be restored successfully
- Whether restored data could reintroduce malware
Do not connect clean backups to a compromised environment. Backup restoration should occur only after responders understand the attack, remove malicious access, and prepare a clean recovery environment.
Prioritize Critical Business Functions
The company should identify which operations must continue and which can remain offline temporarily.
Priority systems may include:
- Emergency and safety services
- Customer communication
- Payroll
- Financial processing
- Healthcare operations
- Order fulfillment
- Production systems
- Critical vendor connections
- Regulatory reporting
- Telephone service
The company’s business continuity plan should provide temporary procedures. This may include manual processes, alternate communication tools, clean replacement devices, or limited operations from an isolated environment.
Employees should receive clear instructions about which systems are safe to use. They should not independently reconnect devices or use personal accounts to work around the outage unless those alternatives have been approved.
Hours 6–18: Control Communications
Poor communication can make a cyberattack worse. Employees may share unverified information, customers may receive conflicting answers, and attackers may monitor the company’s compromised communication channels.
Establish a Trusted Communication Channel
The response team should assume that normal email or collaboration tools may be monitored until they are confirmed safe.
Alternative communication methods may include:
- A separate emergency collaboration platform
- A clean conference bridge
- Verified phone numbers
- Preapproved personal contact information
- An out-of-band incident management system
Sensitive technical details should only be shared with people who need them.
Brief Employees
Employees should receive a concise, factual update explaining:
- What they need to do
- Which systems they must avoid
- How to report suspicious activity
- Whether password changes are required
- Where official updates will be posted
- Who may speak publicly about the incident
- How to respond to customer questions
Employees should be warned that attackers may use the disruption to send phishing emails, fake password-reset messages, fraudulent invoices, or impersonation requests.
Prepare External Communications Carefully
Customers, vendors, regulators, and the public may eventually need to be informed. However, the business should avoid releasing incomplete or speculative information.
An initial statement may acknowledge a technology disruption, explain that specialists are investigating, and provide a safe contact method. Any statement should be reviewed by legal counsel and the designated communication lead.
The company should avoid:
- Guessing how many people are affected
- Claiming that no data was stolen before confirming that fact
- Minimizing a serious event
- Blaming a specific person or vendor prematurely
- Sharing technical details that could assist the attacker
- Promising a recovery time that has not been validated
Transparent communication matters, but accuracy is more important than speed when the facts are still developing.
Hours 12–24: Begin Controlled Recovery
Recovery should not begin simply because the company wants to resume normal operations. Restoring systems too quickly can allow the attacker to return or cause malware to spread again.
Remove the Attacker’s Access
Before restoring critical systems, responders may need to:
- Remove malware and unauthorized software
- Close the original entry point
- Patch exploited vulnerabilities
- Disable malicious accounts
- Reset privileged credentials
- Rotate tokens, certificates, and API keys
- Remove unauthorized email rules
- Review remote access tools
- Reconfigure security controls
- Block known malicious indicators
- verify that administrative systems are clean
Credential changes should be performed in a coordinated order using known-clean systems. If the identity platform remains compromised, new passwords could also be exposed.
Restore Systems in Priority Order
Systems should be restored according to business importance and technical dependencies.
For example, identity services, network security, and core infrastructure may need to be restored before business applications can operate safely. Each restored system should be tested and monitored before additional systems are brought online.
Recovery teams should verify:
- The source of the restored data
- The integrity of the backup
- The security of the recovery environment
- Required patches and configurations
- User access permissions
- Logging and monitoring
- Connections to other systems
- Application functionality
Recovery may take longer than 24 hours. The objective of the first day is to establish a safe, organized path toward restoration—not necessarily to return every system to normal.
Increase Monitoring
Even after the initial threat appears contained, the attacker may still have another route into the environment.
The company should increase monitoring for:
- Failed and unusual sign-in attempts
- New administrator accounts
- Unexpected privilege changes
- Suspicious outbound traffic
- Unusual data transfers
- Malware alerts
- Changes to security settings
- New inbox or forwarding rules
- Access from unfamiliar locations
- Attempts to reconnect isolated devices
A lack of new alerts does not automatically prove that the environment is clean.
Should a Business Pay a Ransom?
A business should not make this decision alone or under pressure from the attacker.
The FBI discourages paying ransom because payment does not guarantee that data will be restored or kept private. Payment may also encourage future attacks. In addition, transactions involving certain sanctioned entities can create serious legal concerns.
If a ransom demand is received, the company should involve:
- Executive leadership
- Legal counsel
- The cyber insurance carrier
- Law enforcement
- Qualified incident response professionals
The company should preserve all communications with the attacker. Employees should not begin an independent negotiation or use personal accounts to contact the criminal.
Common Mistakes Businesses Make During a Cyberattack
The first day is stressful, but avoiding a few common mistakes can significantly improve the response.
Waiting to Call for Help
A company may lose valuable time while attempting to determine whether the problem is “serious enough.” Early involvement from qualified responders can help contain the attack and preserve evidence.
Shutting Down Everything Without a Plan
A full shutdown may sometimes be necessary, but it can also interrupt critical operations, destroy temporary evidence, and eliminate security visibility. The response should be coordinated whenever circumstances allow.
Restoring Backups Too Soon
Restoring data before securing the environment may reinfect systems or allow the attacker to regain access.
Using Compromised Communication Tools
If attackers control an email account, they may be able to read the company’s response plans and impersonate executives. Important response communications should use a verified, trusted channel.
Making Public Statements Before Confirming the Facts
Early assumptions may later prove incorrect. The business should communicate carefully and update stakeholders as reliable information becomes available.
Failing to Document Decisions
A detailed timeline helps technical investigators, legal counsel, insurers, regulators, and company leadership understand what occurred. It also supports improvements after the incident.
What Should Happen After the First 24 Hours?
Incident response does not end after the first day. The organization may need to continue investigating, recovering systems, notifying affected parties, monitoring for attacker activity, and improving security controls.
The company should eventually conduct a formal review that asks:
- How did the attacker gain access?
- Why was the activity not prevented or detected earlier?
- Which controls worked?
- Which controls failed?
- Was the incident response plan effective?
- Were employees prepared?
- Were backups usable?
- Did vendors respond appropriately?
- What security improvements are necessary?
- Who is responsible for completing those improvements?
The goal is not to blame an individual. It is to address the technical and organizational conditions that allowed the incident to occur or become more damaging.
How Can Businesses Prepare Before a Cyberattack Happens?
The first 24 hours will be far more manageable if the business prepares in advance.
Every organization should consider having:
- A written incident response plan
- Current emergency contact information
- Clearly assigned response roles
- A cyber insurance policy review
- Offline or immutable backups
- Tested restoration procedures
- Endpoint detection and response
- Multifactor authentication
- Centralized security logging
- Network segmentation
- Employee cybersecurity training
- An inventory of systems and data
- A relationship with an incident response provider
- A secure alternative communication method
- Regular tabletop exercises
A plan that has never been tested may fail when the company needs it most. Tabletop exercises allow leaders and employees to practice responding to a realistic scenario without the pressure of a live attack.
How Datawise Networks Can Help
A cyberattack can quickly become a business-wide crisis. Datawise Networks helps small and mid-sized organizations strengthen their cybersecurity, prepare for incidents, and build more resilient technology environments.
Depending on your organization’s needs, our services can help with:
- Cybersecurity risk assessments
- Managed detection and response
- Endpoint protection
- Identity and access security
- Cloud security
- Backup and disaster recovery planning
- Network monitoring and management
- Employee security awareness training
- Incident response planning
- Technology roadmaps
- Fractional CIO and security leadership
- Managed and co-managed IT services
Preparation cannot eliminate every cyber risk, but it can reduce confusion, shorten response time, and limit the impact of an attack.
Frequently Asked Questions
What is the first thing a business should do during a cyberattack?
The business should immediately report the suspected incident, activate its response plan, and contact its IT or cybersecurity team. Affected systems may need to be isolated quickly, but employees should avoid deleting files, restarting devices, or attempting unapproved repairs.
Should an infected computer be turned off?
Not automatically. Disconnecting the device from the network may stop the spread while preserving information in its active memory. However, an actively destructive system may require immediate shutdown. Obtain guidance from an incident response professional when possible and document any action taken.
When should a cyberattack be reported to law enforcement?
Ransomware, fraud, data theft, extortion, and network intrusions may warrant prompt reporting. Legal counsel and the response team can help determine which agencies should be contacted. Ransomware incidents can be reported to the FBI or through IC3.gov.
Should customers be notified immediately?
Customers should be notified when legally required or when doing so is necessary to protect them. The timing and content should be coordinated with legal counsel. The company should avoid making unsupported claims before understanding what information was affected.
How long does recovery from a cyberattack take?
Recovery can take hours, days, or weeks depending on the attack’s scope, the condition of the backups, the number of affected systems, and the attacker’s level of access. Systems should be restored safely rather than brought online before the threat has been removed.
Can cyber insurance manage the entire response?
Cyber insurance can provide valuable financial support and access to approved professionals, but the business still needs an internal response plan, accurate system information, responsible decision-makers, and appropriate security controls.
Prepare Now—Before the First 24 Hours Begin
The first 24 hours of a cyberattack are not the time to decide who should be called, where backups are stored, or who has authority to shut down a system. Those decisions should be made before an incident occurs.
A prepared business can recognize the warning signs, activate the right team, contain the threat, preserve evidence, communicate responsibly, and begin recovery with greater confidence.
If your business does not have a documented and tested cybersecurity incident response plan, Datawise Networks can help you assess your current readiness and build a practical response strategy.
Contact Datawise Networks to discuss cybersecurity, managed IT services, incident preparation, backup and disaster recovery, or fractional technology leadership.
