Monday morning. A client calls: they have received an email from your mailbox with a new bank account for payment, and you never sent it. Or an employee opens the shared folder and, instead of documents, sees files with an unknown extension and a ransom note.
At a moment like this, the first reaction often makes things worse: someone deletes emails, restarts the server or pays to "get it over with". Below is what to do in the first hours of the most common incidents in a small company, and what not to do.
In short:
- First, find out what happened and what is affected - the mailbox, one computer or the whole office.
- Limit the damage: change the password from a clean device, or disconnect the affected computer from the network.
- Don't delete anything and don't pay a ransom - keep the evidence for the investigation.
- Warn your clients and your bank if there is a risk of a fake payment.
The first 15 minutes: find out what is going on
Before you act, answer three questions:
- What exactly did you see - an email you didn't send, encrypted files, an unknown sign-in, missing money?
- What is affected - one mailbox, one computer, the server or everything?
- When did it start - today, or did someone notice something days ago?
Write down the time and take screenshots. Call your IT support and describe what you see. The steps differ depending on the type of attack - that is why finding out comes first.
Hacked email
This is the most common incident. Signs: clients receive emails you didn't send; there are unknown messages in "Sent"; you can't sign in with your password.
- Change the password from another, clean device - not from the computer that may be infected.
- Sign out of all sessions - in Microsoft 365 this cuts off the attacker, even if they signed in with your password.
- Turn on two-factor sign-in if you don't have it. See why businesses use MFA.
- Check the mailbox rules - attackers often add forwarding to an outside address or a rule that hides clients' replies.
- Check "Sent" and "Deleted" to see which clients received emails.
- Warn the clients who may have received a fake email - by phone, not by replying to the same email.
More on protecting email in how to protect company email.
A suspicious payment or a changed bank account
If someone has paid based on an email with a "new account", time matters most.
- Call your bank immediately - sometimes the payment can be stopped if you act on the same day.
- Don't reply to the email - call the supplier or client on a phone number you already had.
- Keep the email with all its details - the bank and the police will ask for it.
Encrypted files (ransomware)
Signs: files won't open, they have a new extension, there is a ransom note.
- Disconnect the affected computer from the network - unplug the cable and turn off Wi-Fi. Don't switch it off and don't delete anything.
- Don't pay the ransom - there is no guarantee you will get the files back, and companies that pay are often attacked again.
- Don't connect the external backup drive to an infected computer - the backup may get encrypted too.
- Check which other computers and shared folders are affected.
Restoring is done from a backup, once it is clear how the attacker got in and the hole has been closed. See ransomware protection for business and disaster recovery plan for businesses.
What not to do
- Don't delete emails, files and logs - they show what happened.
- Don't reinstall right away - first it must be clear where the attacker came in, otherwise they will come in again.
- Don't hide the incident from colleagues - the person who clicked must be able to say so immediately, without fear.
- Don't reuse the same password elsewhere - change it everywhere it was the same.
After the incident
When everything is working again, do a short review: how the attacker got in, what was affected and what changes - two-factor sign-in, updates, better protection of the computers, a backup outside the office. See EDR vs traditional antivirus and backing up company data.
If your company falls under NIS2, significant incidents have deadlines for notifying the authorities - under the directive, the first notification is due within 24 hours of becoming aware. Notification is the company's own obligation, and it is best to have the procedure ready in advance. See the NIS2 compliance guide.
How we do it
When a client comes to us with an incident, we first find out what is going on - what happened, which accounts and systems are affected and since when. Depending on the type of attack, we decide on the next steps and give clear guidance on what to do now and what later.
Many incidents are prevented or caught early: our clients' systems are monitored 24/7, updates are installed regularly and backups are checked. Round-the-clock incident response is a separate service and is agreed in advance.
Frequently asked questions
My email was hacked - is changing the password enough?
No. You also need to sign out of all sessions, turn on two-factor sign-in and check the forwarding rules in the mailbox. Attackers often leave forwarding in place that keeps working after the password is changed.
Should I switch off the computer if the files are encrypted?
Disconnect it from the network - the cable and Wi-Fi - but not from the power. That stops the spread to other computers and keeps the evidence for the investigation.
Should we pay the ransom?
We don't recommend it. There is no guarantee you will get the files back, and companies that have paid are often attacked again. Restoring is done from a backup.
Who should we notify?
Your IT support - right away. Your bank - if there was a payment. Your clients - if they received fake emails from you. If your company falls under NIS2, the authorities too, within the legal deadlines.
How do we know the attacker is gone?
Through an investigation: which accounts signed in from outside, which rules and programs were added, which computers are affected. That is why you shouldn't delete anything until the investigation is done.
Let's talk about your needs and we will offer you the best solution and price.
Tags:
