If a cyberattack hits your business, what you do in the first hour really matters.

It’s also the easiest time to make a costly mistake — turning off the wrong machine, deleting evidence, or emailing about the incident from an account the attacker is already reading.

The steps below are in order so you’re not guessing in the moment. You don’t need to be technical to follow them.

Before anything else: don’t make it worse

Avoid these:

  • Don’t power-off the affected computer if you can avoid it. Disconnecting it from the network is better — powering down can wipe volatile evidence that helps investigators.
  • Don’t delete anything. Leave the ransom note, suspicious email, and alerts where they are.
  • Don’t pay a ransom on the spot.
  • Don’t use the compromised email or accounts to discuss the attack. Switch to phone calls or a clean account.

The step-by-step

Work through these starting the moment something looks wrong:

1. Disconnect affected devices from the network. Unplug the Ethernet cable and turn off Wi-Fi on anything that looks hit. That slows spread to other computers and backups. CISA’s guidance is to isolate devices rather than power them off when you can; shut down only if you can’t get a device off the network any other way.

2. Call your IT provider by phone — immediately. Don’t email if the attacker may be watching the inbox. If you have cyber insurance, call them next; many policies require their incident team early.

3. Leave the evidence alone. Don’t wipe, reinstall, or “tidy up” yet. Screenshots help — keep originals too.

4. If money was sent, call your bank immediately. Ask to recall or freeze the transfer. For wire and bank fraud, the first few hours matter most.

5. Reset passwords from a clean device and turn on MFA. Start with email and admin accounts.

6. Report it. Reporting can help recovery and is sometimes legally required.

Where to report it

  • United States: file with the FBI’s Internet Crime Complaint Center (IC3), and report to CISA.
  • United Kingdom: NCSC and Action Fraud.
  • Australia: ReportCyber (or the 24/7 hotline 1300 CYBER1).

If money was wired to a scammer, report fast. The FBI has stated that reporting wire fraud to IC3 within 72 hours gives its Recovery Asset Team the best chance of clawing funds back — and that team recovers funds in a high share of cases reported in time (about 70% in figures the Bureau has published for timely reports).

If personal data about customers or staff was exposed, you may need to notify a regulator and affected people — sometimes on a short clock. U.S. state breach-notification laws vary; other regions have their own rules (for example GDPR timelines in the UK/EU). Ask counsel or your IT provider early so you don’t miss a deadline. (This post is operational guidance, not legal advice.)

Should you pay the ransom?

The FBI does not recommend paying. Paying doesn’t guarantee files back, can mark you as a payer, and funds further attacks.

It’s still a business decision — make it with law enforcement, your IT or incident-response team, and your insurer, not alone in the first panicked hour. Sometimes a free decryptor already exists for the strain that hit you; another reason to get experts involved before anyone pays.

The best time to prepare is before it happens

You don’t need a thick binder. A single page is enough for most small businesses:

  • Who to call first (IT provider, insurer) and numbers you can reach without your main systems.
  • Where backups live — and proof they’ve been tested by restoring from them.
  • Which accounts and devices matter most so you know what to protect first.

At West Computers we help Pine Belt clients build that one-pager and pair it with monitored detection, immutable backups, and a clear after-hours path — so the first hour isn’t improvisation.

Frequently asked questions

What’s the first thing to do in a cyberattack?
Disconnect affected devices from the network (unplug cable, turn off Wi-Fi), then call your IT provider by phone.

Should I turn off the computer if I get ransomware?
Prefer isolating it from the network over powering off. Shut down only if you can’t get it offline any other way.

Should I pay the ransom?
The FBI does not recommend it. Decide with law enforcement, your IT/IR team, and your insurer — and check for a free decryptor first.

We wired money to a scammer. What do we do?
Call the bank immediately to recall the transfer. In the U.S., report to IC3 within 72 hours for the best recovery odds.

Who do I report a cyberattack to?
In the U.S.: IC3 and CISA. Also notify your cyber insurer, and check any legal duty to notify a regulator if personal data was exposed.

Article adapted with permission from The Technology Press.