When a cyberattack hits your business, the first hour can make all the difference.
It’s also the point where many companies unintentionally make things worse. Shutting down the wrong computer, deleting evidence, or communicating through an email account that’s already compromised can create bigger problems and make recovery more difficult.
The good news is you don’t need to be a cybersecurity expert to take the right first steps.
This guide walks through exactly what to do when you suspect a cyberattack, helping you protect your business while your IT team or security professionals take over.
Before Anything Else: Avoid These Common Mistakes
If you think you’ve been attacked, stop and take a breath before making any changes.
Avoid the following:
- Don’t power off the affected computer unless absolutely necessary. Disconnecting it from the network is usually the better option because shutting it down can remove valuable information investigators need to determine what happened.
- Don’t delete suspicious emails, ransomware notes, files, or alerts. Leave everything exactly as it is.
- Don’t rush to pay a ransom. Making a payment too quickly can complicate the recovery process and does not guarantee you’ll regain access to your data.
- Don’t use potentially compromised email accounts or systems to discuss the incident. If attackers have access to those accounts, they may be able to see those conversations. Use a phone call or another trusted communication method instead.
What to Do Step by Step
Work through these actions in order as soon as you notice something isn’t right.
1. Disconnect Affected Devices From the Network
Immediately isolate any devices that appear to be compromised.
- Unplug network cables.
- Disable WiFi connections.
- Disconnect affected systems from VPN connections if applicable.
The goal is to prevent the attack from spreading to additional computers, servers, or backups.
Cybersecurity experts generally recommend isolating systems rather than shutting them down whenever possible.
2. Contact Your IT Provider Immediately
Call your IT provider or cybersecurity partner right away.
A phone call is often safer than email during an active incident because you may not know whether email accounts have been compromised.
If your organization has cyber insurance, contact your carrier as soon as possible. Many policies require the insurer to be involved early in the incident response process.
3. Preserve the Evidence
Resist the urge to clean things up.
Do not:
- Reinstall operating systems
- Delete files
- Run cleanup utilities
- Restore from backup yet
Screenshots of suspicious messages, ransom notes, or unusual activity can be helpful, but always keep the original evidence intact for investigators.
4. Contact Your Bank if Money Was Sent
If you suspect fraudulent wire transfers, ACH payments, or other financial fraud, notify your bank immediately.
The sooner your bank is informed, the greater the chance they may be able to stop, reverse, or freeze the transaction before funds are moved elsewhere.
5. Reset Passwords and Enable Multi Factor Authentication
Using a device you know is clean and unaffected:
- Change passwords for email accounts first.
- Reset administrator account credentials.
- Change passwords for critical business systems.
- Enable Multi Factor Authentication (MFA) wherever available.
Email accounts are often the primary target because they can be used to access many other business systems.
6. Report the Incident
Reporting a cyberattack can help protect your business and may be required by law depending on the circumstances.
The appropriate reporting agency depends on your location.
Where to Report a Cyberattack
United States
Report the incident to:
- The FBI’s Internet Crime Complaint Center (IC3)
- The Cybersecurity and Infrastructure Security Agency (CISA)
United Kingdom
Report the incident to:
- National Cyber Security Centre (NCSC)
- Action Fraud
Australia
Report the incident through:
- ReportCyber
- The 24/7 Cyber Security Hotline at 1300 CYBER1
If money was transferred to scammers, report it immediately.
The FBI advises businesses to report wire fraud to IC3 as quickly as possible. Fast reporting gives investigators the best opportunity to help recover stolen funds.
If customer or employee information was exposed, additional reporting obligations may apply depending on your location and industry regulations.
Examples include:
- GDPR requirements in the United Kingdom and Europe
- State breach notification laws in the United States
- Australia’s Notifiable Data Breaches Scheme
Consult your legal counsel and IT provider as soon as possible to ensure you meet any required deadlines.
Should You Pay the Ransom?
When ransomware is involved, one of the first questions businesses ask is whether they should pay.
Law enforcement agencies, including the FBI, generally advise against paying a ransom.
Paying does not guarantee that:
- Your files will be restored
- Attackers will keep their promises
- Your data won’t be leaked later
It also demonstrates that your organization is willing to pay, which may increase the risk of future targeting.
Every situation is different. Decisions regarding ransom demands should be made in consultation with law enforcement, your incident response team, cybersecurity professionals, and your cyber insurance provider.
In some cases, free decryption tools already exist for specific ransomware variants, making professional guidance especially important before considering payment.
The Best Time to Prepare Is Before an Attack Happens
Responding to a cyberattack is significantly easier when you have a plan in place beforehand.
Most small businesses don’t need a complicated incident response manual. A simple one page plan is often enough.
At minimum, your plan should include:
- Emergency contact information for your IT provider and cyber insurance carrier
- A record of where backups are stored and confirmation they have been tested
- A list of critical systems, devices, and accounts that should be prioritized during an incident
Having these basics documented before an attack occurs can save valuable time and reduce stress when every minute matters.
Frequently Asked Questions
What’s the First Thing I Should Do During a Cyberattack?
Disconnect any affected device from the network by unplugging network cables and disabling WiFi. Then contact your IT provider immediately by phone. Isolating the device helps prevent the attack from spreading.
Should I Turn Off a Computer Infected With Ransomware?
If possible, disconnect it from the network instead of powering it off. Shutting down a system can remove valuable forensic evidence stored in memory. Power it off only if there is no other way to isolate it.
Should I Pay the Ransom?
Law enforcement generally advises against paying. There is no guarantee you will recover your data, and payment can encourage future attacks. Consult with cybersecurity professionals, legal counsel, law enforcement, and your insurance provider before making any decision.
We Sent Money to a Scammer. What Should We Do?
Contact your bank immediately and request that the transaction be recalled or frozen. Report the incident to the appropriate authorities as quickly as possible. Fast action offers the best chance of recovering funds.
Who Should I Report a Cyberattack To?
In the United States, report cyber incidents to IC3 and CISA. In the United Kingdom, report them to the NCSC and Action Fraud. In Australia, report them through ReportCyber. You should also notify your cyber insurance provider and determine whether any regulatory reporting requirements apply.