A cyberattack rarely comes with a warning. One moment, everything is running normally; the next, files may be locked, accounts compromised, systems unavailable, or money at risk.
Recent government cyber-threat reporting recorded more than 84,700 cybercrime reports in a single year, averaging one report every six minutes.
For business owners, those first few minutes can feel overwhelming. But the first hour isn’t about fixing everything yourself.
It’s about staying calm, limiting the damage, protecting valuable evidence, and getting the right people involved before the situation gets worse.
The actions you take, and the mistakes you avoid, can make a real difference to how quickly your business recovers.
Keep reading to learn what not to do during a cyberattack, the six steps to take in order, who to contact, and how to prepare before an incident ever happens.
Know What Not to Do During a Cyberattack
When a cyberattack hits, the instinct is often to act quickly and fix whatever looks wrong.
But rushed decisions can destroy useful evidence, interrupt recovery, or make the situation harder to control. Before taking action, avoid these common mistakes:
- Don’t immediately switch off affected devices. Isolate them from the network instead, where possible.
- Don’t delete suspicious emails, alerts, logs, or ransom messages. They may contain useful evidence.
- Don’t communicate through compromised accounts. Use a trusted phone or alternative communication channel instead.
- Don’t rush into paying a ransom. Get professional, legal, and insurance guidance first.
- Don’t wipe or reinstall affected systems. Major changes can destroy evidence needed for investigation.
Knowing what not to do can stop a stressful situation from becoming even worse.
The first-hour goal isn’t to solve everything yourself; it’s to limit damage and preserve what investigators may need.
Once those mistakes are avoided, the next step is following a clear response plan in the right order.
The First-Hour Cyberattack Response Plan: 6 Steps in Order
Once you’ve avoided the actions that can make an attack worse, the focus shifts to containment and response.
You don’t need to solve everything immediately, but you do need to take the right steps in the right order.
1. Isolate the Affected Devices
Disconnect affected computers and devices from Wi-Fi, wired networks, and other connected systems.
This can help stop malicious activity from spreading across your business while keeping the device available for your IT or cyber security team to investigate.
2. Call Your IT or Cyber Security Provider
Contact your IT or cyber security provider as soon as the affected devices are isolated.
Use a phone or trusted communication channel rather than potentially compromised email, and clearly explain what happened, when you noticed it, and which systems are affected.
3. Preserve Evidence and Record What Happened
Leave suspicious emails, ransom messages, alerts, and affected files exactly where they are.
Take screenshots where appropriate and write down when the problem started, what employees noticed, and any actions already taken to help investigators understand the incident.
4. Contact Your Bank if Money Is at Risk
If money has been transferred fraudulently or financial accounts may be compromised, contact your bank immediately.
Explain what happened and ask whether payments can be stopped, accounts secured, or suspicious transactions investigated before further financial damage occurs.
5. Secure Critical Accounts From a Clean Device
Use a device you know is unaffected to secure important accounts, beginning with email, administrator, and financial accounts.
Reset compromised passwords, enable multi-factor authentication where necessary, and follow your IT provider’s guidance before making wider account changes.
6. Report the Cyberattack
Once the immediate threat is being managed, report the incident through the appropriate channels.
Depending on what happened, this may involve cybercrime authorities, your insurer, regulators, or other relevant parties, particularly when sensitive information or financial loss is involved.
Following these six steps gives your business a structured way to respond without making rushed decisions under pressure.
Just as important, however, is knowing exactly who needs to hear about the attack and when.
Who Should You Contact After a Cyberattack?
Once the immediate response is underway, the right people need to know what has happened.
Who you contact will depend on the attack, but acting quickly can help contain damage, protect finances, and meet important reporting obligations.
The same cyber-threat data found that average self-reported cybercrime losses for businesses increased by 50% to $80,850 per report, reinforcing why financial and technical support should be contacted quickly.
Key contacts may include:
- IT or cyber security provider: Get technical support to investigate, contain, and manage the incident.
- Cyber insurer: Notify your insurer early and follow any required incident response procedures.
- Bank or financial institution: Report suspicious transfers or compromised financial accounts as quickly as possible.
- Legal or privacy adviser: Seek guidance if sensitive, customer, or employee information may be exposed.
- Cybercrime reporting authorities: Report serious cyber incidents through the appropriate official reporting channels.
- Relevant regulators: Notify regulators where data breach or industry-specific reporting obligations may apply.
Making the right calls is important, but communication is only one part of the response.
Once the immediate threat is under control and the necessary parties are involved, attention needs to shift towards understanding the damage and recovering safely.
That means finding out exactly what was affected before returning to business as usual.
What Happens After the Immediate Threat Is Contained?
Containing the attack is a major first step, but it doesn’t mean the incident is over.
Before returning to normal operations, you need to understand what was affected, make sure the attacker is gone, and recover without creating new risks.
The next priorities should include:
- Identify affected systems, accounts, and data: Establish the full scope of the cyberattack.
- Confirm attackers no longer have access: Check compromised accounts, sessions, permissions, and entry points.
- Restore systems and backups safely: Recover only after confirming systems and backups are clean.
- Monitor for further suspicious activity: Watch closely for unusual logins, alerts, or recurring malicious activity.
- Investigate how the attack happened: Identify the original weakness or access point attackers exploited.
- Determine who needs to be notified: Consider affected customers, employees, partners, and other relevant parties.
- Document the incident and lessons learned: Record what happened and where your response needs improvement.
Recovery isn’t simply about getting systems running again.
It’s also an opportunity to understand what went wrong and reduce the chance of the same weakness being exploited twice.
The best way to make that process easier is to have the key decisions, responsibilities, and recovery steps worked out before an attack ever happens.
Build a Cyberattack Plan Before You Actually Need One
The middle of a cyberattack is a terrible time to decide who should make decisions, where your backups are, or how your team should communicate.
A simple plan prepared in advance removes that guesswork and helps everyone respond faster when pressure is high.
Keep Emergency Contacts Available Offline
Keep contact details for your IT provider, cyber insurer, bank, legal adviser, and other essential contacts somewhere accessible without your main systems.
If email or cloud services become unavailable, your team should still know exactly who to call.
Assign Roles and Identify Critical Systems
Decide who will contact your IT provider, communicate with employees, approve decisions, and manage external notifications.
At the same time, identify the systems, accounts, and data your business depends on most so everyone knows what needs protecting first.
Test Your Backups Regularly
Knowing where your backups are stored isn’t enough. Test them regularly by restoring data and confirming that critical systems can actually be recovered.
A backup that exists but cannot be restored offers little help when your business needs it most.
Establish a Backup Communication Method
If business email or messaging systems are compromised, employees need another safe way to communicate.
Decide in advance whether your team will use phone calls, text messages, or another trusted channel during an incident, and make sure everyone knows it.
Keep a Simple Response Checklist and Test It
Create a one-page cyberattack response checklist covering key contacts, responsibilities, critical systems, and immediate actions.
Run simple incident-response exercises periodically so employees understand the plan and can identify gaps before they have to use it during a real attack.
Preparation doesn’t prevent every cyberattack, but it can make the difference between an organised response and an hour of confusion.
When the basics are already decided, your team can focus on containing the threat, protecting the business, and starting recovery.
Final Words: When a Cyberattack Happens, the First Hour Matters
A cyberattack can create confusion quickly, but the first hour becomes much easier when everyone knows what to do.
Staying calm and following a clear sequence can help limit damage, protect evidence, and give your business a stronger path towards recovery.
Keep these five priorities in mind:
- Isolate affected devices before the threat spreads further.
- Call your IT or cyber security provider immediately.
- Preserve evidence that may help investigate the attack.
- Protect and report compromised accounts, data, or financial activity.
- Recover carefully once systems are confirmed safe.
Preparation makes every one of these steps easier when time matters most.
PowerbITs can help assess your cyber security, test backups, and build a practical incident-response plan. Get in touch today to strengthen your business before an attack puts that plan to the test.
