What to Do If Your Business Is Hacked: The First 24 Hours

Maybe the screens are showing a ransom note. Maybe a customer called to ask why you emailed them a new bank account number. Maybe your bank flagged a wire you did not send. However you found out, your next few hours matter more than almost anything else in the incident.

The instinct is to start fixing things right away: wipe the laptop, reboot the server, delete the strange emails. Those moves can destroy the evidence you need, alert the attacker and make recovery harder. This checklist walks you through the first 24 hours in order, so you contain the damage without making it worse.

If you have an incident response plan, open it now. If you do not, use this page as your plan for today and build a proper one next month with our guide on how to create an incident response plan.

The first 24 hours at a glance

Hour 0 to 1: stop the spread

1. Disconnect, do not shut down. Unplug network cables and turn off Wi-Fi on affected computers, or ask your IT provider to block them at the switch or firewall. CISA’s ransomware response checklist says to isolate impacted systems immediately and to power down only if you cannot disconnect them, because shutting down destroys evidence held in memory. The FTC gives the same advice for data breaches: take affected equipment offline, but leave it on until forensic experts arrive.

2. Do not wipe, reinstall or delete anything. Ransom notes, strange emails and unknown programs are evidence.

3. Switch to safe communication. Assume the attacker may be reading company email or chat. Use phone calls or a separate, clean account. CISA’s checklist specifically warns that attackers may monitor your communications.

4. Call your IT provider or internal IT lead. Tell them what you saw, when, and on which devices.

5. Call your cyber insurance carrier. Many policies require prompt notice and expect you to use their approved forensic firms and attorneys. Calling first can protect your coverage.

6. Start an incident log. Write down every action, time, person and observation. This record helps investigators, insurers and attorneys later.

Hours 1 to 4: contain the damage and preserve evidence

Lock down compromised accounts. Reset passwords for affected accounts, sign them out of all sessions, and reset their MFA methods. Prioritize email, your identity provider, banking, payroll and admin accounts. If an attacker may still be inside, coordinate resets with your IT provider so you do not tip them off before you can lock everything at once.

Check email for attacker tricks. In email compromise cases, attackers often create forwarding rules or rules that hide replies from the real account owner. Remove them and note what they were.

Protect your backups. Disconnect backup drives and confirm your cloud backups are intact. Attackers often target backups to force a ransom payment. Do not restore anything yet.

Preserve logs. Ask your IT provider to export sign-in logs, firewall logs and email audit logs before they roll over. Cloud platforms keep many logs only for a limited time, depending on your plan.

Block what you know. Block malicious sender addresses, suspicious IP addresses and any remote access tools the attacker installed, once they are documented.

Key takeaway: Contain first, investigate second, restore third. Restoring systems before you know how the attacker got in often leads to being hacked again through the same door.

Hours 4 to 8: bring in experts and report

Forensic help. If the incident involves ransomware, data theft or an unknown intruder, bring in an incident response or digital forensics firm, often through your insurer. They will find how the attacker got in, what they touched and whether they are still present.

An attorney. Involve outside counsel with data breach experience, especially if personal data may be involved. Counsel can help you assess notification duties and, in some cases, direct the investigation.

Your bank, immediately, if money moved. For business email compromise or a fraudulent wire, call your bank’s fraud line and ask it to recall or freeze the transfer. Speed is critical; the FBI’s IC3 guidance stresses contacting your financial institution as soon as you discover a fraudulent transfer.

Report to federal law enforcement.

• File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov, and include banking details for any payment fraud.
• Contact your local FBI field office for serious intrusions or ransomware.
• Report to CISA through cisa.gov/report or by phone at 888-282-0870. CISA’s ransomware checklist recommends reporting and considering a request for assistance.

Reporting does not mean you lose control of the response. Law enforcement may have information on the attacker or available decryption tools.

Should you pay a ransom?

Do not decide in the first few hours, and never alone. The FBI has said it does not support paying ransoms, because payment does not guarantee you get your data back and it funds further attacks. The US Treasury’s Office of Foreign Assets Control (OFAC) has also warned, in an advisory updated on September 21, 2021, that paying certain attackers can violate US sanctions.

Before any decision, check your backups, talk to law enforcement about available decryptors, and involve your insurer and attorney. This is not legal advice. Our ransomware protection guide covers how to make this decision less likely in the future.

Hours 8 to 16: understand what happened

With containment in place, work with your IT provider or forensic firm to answer 5 questions:

1. How did they get in? A phishing email, stolen password, unpatched system or exposed remote access?
2. What did they access? Which systems, accounts and files?
3. What data is involved? Customer names, Social Security numbers, card data, health records, employee files?
4. Are they still inside? Look for new admin accounts, remote access tools and scheduled tasks.
5. What is the business impact? Which operations are down, and what is the cost per day?

Keep notes factual. Avoid guessing in writing about blame or impact before the investigation finishes.

Hours 16 to 24: communicate and plan recovery

Tell your staff. Give employees a short, factual update by phone or a clean channel: what is affected, what they should and should not do, and who to contact. Remind them not to discuss the incident publicly.

Prepare a holding statement for customers and partners who ask. Be honest, avoid speculation and promise updates. The FTC advises naming a single point of contact for releasing information.

Review notification duties. Every state, plus DC, Puerto Rico and the US Virgin Islands, has a data breach notification law, according to the FTC. Rules on deadlines, content and who must be told vary, and health, financial or card data can add federal or industry rules. Contracts with customers may also require notice within a set time. Your attorney should confirm what applies. Our US state data privacy laws guide gives background, but it is not legal advice.

Plan recovery in priority order. Rebuild or clean systems, then restore from backups you have confirmed are clean, starting with what keeps revenue flowing. CISA recommends restoring based on a predefined list of critical assets. Change all passwords again once systems are clean, and require multi-factor authentication everywhere before reconnecting users.

After the first 24 hours

Mistakes that make a hack worse

• Powering off or wiping machines before evidence is collected
• Talking about the incident over the compromised email system
• Restoring from backups before finding how the attacker got in
• Paying a ransom or a fake invoice under pressure without advice
• Forgetting to call the insurer, which can affect coverage
• Announcing details publicly before facts are confirmed
• Skipping the post-incident review once systems are back

The weeks that follow

The emergency phase ends, but the work continues. Over the next weeks, complete forensic findings, send any required notifications, monitor closely for the attacker’s return, and hold a lessons-learned meeting. Then fix the root cause: patch the system, close exposed remote access, enforce MFA or retrain staff. If you lacked outside support this time, consider a managed IT service provider with incident response experience.

Conclusion

The first day after a hack is about discipline. Disconnect without destroying evidence, move to safe communication, call your IT provider and insurer, lock down accounts and protect backups. Then bring in experts, report to the FBI and CISA, call your bank if money moved and get legal advice on notification. Recovery comes last, and it goes much better when you know how the attacker got in.

Sources

• CISA: #StopRansomware Guide — isolating systems, powering down only as a last resort, out-of-band communication, reporting and restoration priorities
• FTC: Data Breach Response, A Guide for Business — evidence preservation, notification and state breach laws
• FBI Internet Crime Complaint Center (IC3) — reporting business email compromise, ransomware and other cyber-enabled crime
• US Treasury OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments — sanctions risk of ransom payments
• CISA: Report a cyber incident — 24/7 incident reporting