What to do in the first hour of a cyber attack

Most small businesses do not get attacked by someone who chose them. They get caught by something automated that found an unpatched system or a reused password. What decides how much damage it does is almost always the first hour.

Disconnect, but do not power off

Take affected machines off the network so whatever is running cannot spread or keep talking to whoever sent it. Unplug the cable, turn off the wifi.

Resist the urge to shut down. A powered off machine loses the memory evidence that shows how the attacker got in, and with ransomware it can make recovery harder rather than easier.

Reset the passwords that matter, in the right order

Start with email, because it is the master key. Anyone holding your inbox can reset everything else. Then your domain registrar and hosting, then banking and payment providers, then your store and ad accounts.

Do the resets from a device you are confident is clean, and turn on multi factor authentication as you go. Sign out all active sessions too, since changing a password does not always evict someone already logged in.

Work out what was actually reached

Check the sign in logs on your email and store admin for unfamiliar locations. Look for mail rules you did not create, a favourite trick that quietly forwards invoices to an attacker. Check for admin users nobody recognises, and on an eCommerce site, look at recent changes to checkout code.

The question is not whether they got in. It is what they touched, and whether any of it was personal data.

Know who you have to tell

In the UK, if personal data has been breached and there is a risk to the people it belongs to, you must report it to the Information Commissioner’s Office within 72 hours of becoming aware. If the risk to those individuals is high, you have to tell them as well.

Fraud and cybercrime can also be reported to Action Fraud. If you take card payments, your payment provider and acquiring bank will have their own reporting requirements, and ignoring those can cost you the ability to take payments at all.

Restore from something you trust

Rebuild from a backup taken before the compromise, not from the machine you have just cleaned. A backup you have never tested is not a backup, it is a hope, and the middle of an incident is a terrible time to discover it has been silently failing for months.

The prevention that actually works

None of it is exciting, which is precisely why it gets skipped:

• Multi factor authentication on email, hosting, banking and store admin
• Updates applied promptly, especially anything public facing
• Backups that are tested and kept where an attacker cannot reach them
• Staff with access only to what their job needs
• People who know what a phishing email looks like, because that is still the usual way in

If you do not have someone responsible for these, that is the gap. It is far cheaper to keep them up to date than to recover from the week when one of them was missing.