What should I do first if my business is hacked?

Isolate affected systems from the network without powering them off, then call your IT provider, your cyber insurance carrier, and your attorney. Disconnecting limits spread while preserving evidence in memory; shutting down destroys that evidence and rarely helps.

Should I turn off a computer that has ransomware on it?

Generally no. Disconnect it from the network — unplug the cable or disable its wireless — but leave it powered on. Volatile memory can contain encryption keys and attacker activity that disappear on shutdown. Follow your incident responder's direction if it differs.

Should I pay a ransomware demand?

That is a decision to make with your attorney and your insurance carrier, not under pressure and not alone. Payment does not guarantee recovery, may carry legal restrictions depending on who the recipient is, and marks you as willing to pay. Notify your insurer before taking any action, because acting first can affect coverage.

Do I have to notify anyone if my business is breached?

Possibly, and the answer depends on what data was involved and which laws apply — California has its own breach notification requirements, and specific rules cover health and financial data. There are deadlines. This is why an attorney is an early call rather than a late one.

Should I call my cyber insurance company right away?

Yes. Most policies require prompt notification and many require you to use approved incident response vendors. Hiring your own firm before notifying the carrier can jeopardize reimbursement. The call costs nothing and protects the coverage you have already paid for.

How do I know if it is really a breach or a false alarm?

You often will not know at the start, and that is fine. Treat a credible suspicion as real until someone qualified determines otherwise. The cost of investigating a false alarm is small; the cost of dismissing a real incident for a week is not.

The First 24 Hours After a Breach

This is written to be read under pressure. If something is happening right now, the first section is the part you need.

The first hour

Disconnect affected systems from the network. Do not power them off.

Unplug the network cable or disable wireless. This stops spread while preserving evidence held in memory — including, sometimes, encryption keys. Powering down destroys that and rarely helps.

Call three numbers, in this order:

Your IT provider or internal IT lead. They begin containment.
Your cyber insurance carrier. Most policies require prompt notice and many mandate approved response vendors. Calling your own firm first can jeopardize reimbursement.
Your attorney. Notification obligations have deadlines, and counsel involvement can affect how the investigation is treated legally.

Stop using the compromised email account for coordination. If email may be compromised, the attacker is reading your response. Move to phone or a channel on separate infrastructure.

Start a written timeline. Plain document, timestamps, what was observed and what was done. This will matter for insurance, for counsel, and for your own recall in three days when the details blur.

What not to do

These are the mistakes I see most often, and each one makes the situation materially worse.

Do not delete anything. Not the suspicious email, not the strange files, not the logs. Evidence determines whether you can establish what happened and what data was affected — which in turn determines your notification obligations.

Do not wipe and reinstall immediately. The instinct is understandable and the result is that you will never know how they got in, whether they are still present, or what they took. Rebuilding without understanding the entry point often restores the vulnerability along with the system.

Do not pay a ransom on your own initiative. Involve counsel and your insurer first. There can be legal restrictions on payment depending on who is being paid.

Do not announce prematurely. You do not yet know what happened. A public statement that turns out to be wrong is a second problem layered on the first. Say nothing externally until counsel advises.

Do not blame the employee who clicked. Beyond being unkind, it guarantees the next person hides their mistake, and delayed reporting is far more damaging than any single click.

Hours two through twenty-four

Once immediate containment is underway, the work turns to scope.

Force password resets and revoke sessions on critical accounts — email, banking, payroll, domain registrar, cloud administration. Note that a password reset alone may not eject an attacker who holds an active session token; revoking sessions explicitly matters.

Check for changes an attacker makes to keep access. Email forwarding rules are the classic one — a rule quietly copying your mail to an outside address. Also check newly added accounts, changed multi-factor settings, new application permissions, and altered recovery addresses.

Verify your backups before you rely on them. Confirm they exist, are recent, and are not themselves encrypted or deleted. Discovering this at hour twenty is much better than at hour seventy.

Check the money. Contact your bank, review pending transfers, and verify that payroll and vendor payment details have not been altered. If a fraudulent wire has gone out, speed matters enormously — same-day notification to the bank gives a real chance of recall.

Preserve logs before they rotate. Many systems overwrite logs on a schedule. Ask your IT provider to export and preserve relevant logs immediately.

Who else may need to be involved

Law enforcement. The FBI takes cybercrime reports and operates IC3 for internet crime complaints. Reporting does not conflict with your insurance process and is sometimes required by policy.

Your bank, if any financial account or payment path is implicated.

Affected individuals or clients, when and how your attorney advises — not before.

After the first day

When the immediate pressure lifts, the useful question is not “who failed” but “what would have stopped this earlier.”

Most incidents I review trace back to something on the small business checklist that was known and not done — usually multi-factor authentication, or a backup nobody had tested. The post-incident window is the one moment when a business will actually fund those changes. Use it.

If the incident involved an internet-facing system, this is also the point at which a real penetration test becomes worth commissioning, because you now have a specific question to answer rather than a general one.

Keep this accessible offline

The failure mode of any incident plan is that it lives on the file share that just got encrypted. Print the three phone numbers — IT, insurance, attorney — and keep them somewhere physical. That single page is the highest-return preparation in this guide.