What to Do in the First Hour After a Cyber Attack
The first hour after you discover a cyber attack shapes everything that follows: how much data you lose, whether money can be recalled and whether evidence survives. This checklist tells you exactly what to do, and what not to do, while the pressure is at its highest.
Key takeaways
- Isolate, do not wipe: disconnect affected devices from the network but keep them intact until you have taken advice, so evidence is preserved.
- If money has left the business, call your bank immediately. Speed is the biggest factor in any recall.
- Start a written log with times from the very first minute.
- Change passwords and sign out sessions from a clean device, starting with email.
- Call your insurer's incident hotline early, and check whether personal data was involved, because the UK ICO deadline is 72 hours.
You notice it on a Tuesday morning. Files on the shared drive have strange extensions, a customer phones to ask why you emailed them a payment link, or your bank calls about a transfer you do not recognize. Your heart rate jumps and the instinct is to do something, anything, right now.
That instinct is useful only if it is pointed in the right direction. Rebooting servers, deleting suspicious emails or paying a demand on the spot can make the situation worse. This checklist covers the first 60 minutes, minute by minute, for a small business without its own security team. It is the emergency card version of a full incident response plan, and you can print it and keep it next to your phone list.
A quick note before you start: this article is general information, not legal advice. Reporting duties and insurance terms vary, so check GOV.UK, the ICO, the FTC or a qualified adviser for your situation.
Minutes 0 to 5: stop, breathe and start a log
The person who spots the problem should raise the alarm immediately and stop using the affected device for anything else. Then one person, usually the owner or manager, takes charge. Two people giving conflicting instructions is a common source of damage in small teams.
Open an incident log
Grab a paper notebook or use a device you are confident is unaffected. Write down the time and what you saw. From now on, every action gets a line: who did what, on which device, and when. This log helps your IT provider, your insurer and the police, and it is the basis of any report to a regulator later.
- What was noticed, by whom, and at what time
- Which devices, accounts and systems seem affected
- Any messages, ransom notes or pop-ups (photograph them with a phone rather than saving files)
- Every phone call made, with the name of the person you spoke to
Pro tip
Assume your email may be compromised. Coordinate by phone, or in person, until you know email is safe. Attackers who control a mailbox can read your incident messages and adapt.
Minutes 5 to 15: contain the damage without destroying evidence
Containment means stopping the attack from spreading while keeping what investigators need. The key rule from incident response guidance is simple: isolate affected devices from the network, but do not wipe them or power them off before you have taken advice.
- Disconnect from the network: unplug the network cable and turn off Wi-Fi on affected computers. Leave them powered on unless your IT provider tells you otherwise, because some evidence lives only in memory.
- Check neighbors: look at shared drives and other machines for the same symptoms, and isolate those too.
- Pause sync: if files are being changed, pause cloud sync tools so damaged files do not overwrite good copies everywhere.
- Protect backups: disconnect any backup drive that is still attached, and do not connect a backup to a machine that may be infected.
- Leave the attacker's traces alone: do not delete suspicious emails, forwarding rules or new user accounts yet. Note them and photograph them instead.
Common mistake
Wiping and reinstalling a computer in the first hour to "get back to work". It destroys the evidence that shows how the attacker got in and what they took, which you may need for your insurer and for any data breach assessment. It can also leave you reinfected if the real entry point was somewhere else.
Minutes 15 to 30: make the urgent calls
Now pick up the phone. Use numbers from your own records or your incident contact sheet, not numbers from any email or pop-up that arrived during the attack.
Your bank, if any money moved
If a payment went to a fraudster, for example because of a fake invoice or changed bank details, call your bank's fraud line straight away. Banks can sometimes stop or recall transfers, but only if they hear about it quickly. Ask them to contact the receiving bank, and note the reference number they give you. In the US, ask specifically about recalling a wire transfer.
Your IT provider or a specialist
If you have a managed IT provider, call them now. If you do not, your cyber insurer may provide an incident response team as part of the policy. Tell them what you have isolated and what you have not touched.
Your insurer's hotline
Many cyber insurance policies have a 24-hour incident line and require you to notify them promptly. Some also require you to use their approved responders. Calling early protects your claim and often gets you expert help faster than you could find it yourself.
| Who to call | When | What to have ready |
|---|---|---|
| Bank fraud line | Immediately if money left the account | Payment amount, date, time and payee details |
| IT provider or responder | As soon as devices are isolated | List of affected devices and symptoms |
| Cyber insurer hotline | Within the first hour if you have a policy | Policy number and your incident log |
| Police or fraud reporting service | Once the urgent containment is done | Timeline, losses and any attacker contact details |
Minutes 30 to 45: lock down accounts from a clean device
Many attacks begin with a stolen login, and attackers often keep a second way back in. Once the immediate spread is under control, take back your accounts. The important detail is where you do it: change passwords from a clean device, such as a phone or laptop that was not involved, because a compromised machine may be recording what you type.
- Email first: reset the password of any affected mailbox, sign out all sessions and check that multi-factor authentication is still on and still linked to your own phone.
- Check mailbox rules: look for forwarding rules or filters you did not create, such as rules that forward invoices to an outside address or move bank replies to a hidden folder. Note them, then remove them with your IT provider's agreement.
- Banking and payments: change online banking passwords and check for new payees or changed limits.
- Admin accounts: reset passwords for administrator accounts, cloud consoles, your domain registrar and your password manager, and look for new users you did not add.
- Shared logins: change any password that was stored on or typed into an affected device.
Example
Imagine a five-person design studio, Northlight Studio, where the owner notices that a client received an invoice with different bank details. She disconnects the office manager's laptop from Wi-Fi, calls the bank on the number printed on her card, and then uses her own phone to reset the office manager's email password and sign out all sessions. In the mailbox settings she finds a rule forwarding every message containing "invoice" to an unknown address. She photographs it, notes the time in her log and asks her IT contractor to remove it. By the end of the hour the client has been warned by phone and the bank has a recall request in progress.
Minutes 45 to 60: report, notify and decide next steps
With the bleeding stopped, turn to reporting and to the decisions that will guide the rest of the day.
Report the crime
In England, Wales and Northern Ireland, report cyber crime and fraud to Report Fraud, which replaced Action Fraud on 4 December 2025. You can report online at reportfraud.police.uk or by phone on 0300 123 2040. In Scotland, call Police Scotland on 101. In the US, report cyber crime and business email compromise to the FBI's Internet Crime Complaint Center at ic3.gov, and scams or identity theft to the FTC at ReportFraud.ftc.gov. A crime reference number is often needed by banks and insurers.
Ask whether personal data was involved
If customer, staff or supplier personal data may have been accessed, encrypted or stolen, you could have a personal data breach. Under UK GDPR, you must report a breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms. The same 72-hour rule applies in the EU with your national supervisory authority. In the US, state breach notification laws vary, so take advice on which apply.
You do not need every answer in the first hour, but you should start the clock in your log and tell whoever handles data protection. Record the breach even if you later decide it does not need reporting.
Handle any ransom demand carefully
If a ransom note appears, do not reply or pay in the first hour. Paying does not guarantee you get your files back, and it may be illegal if the group behind the attack is sanctioned. Involve law enforcement and your insurer before making any decision.
Decide what to tell staff and customers
Give staff a short, clear instruction: which devices not to use, which channel to use for updates and who to send questions to. For customers, wait until you know the basics, but warn anyone who may receive fake invoices or emails from your accounts, by phone if possible.
Your first-hour checklist
- One person in charge and an incident log started with times
- Affected devices disconnected from the network, not wiped or powered off
- Cloud sync paused and backups disconnected and protected
- Bank fraud line called if any money moved
- IT provider or incident responder contacted
- Cyber insurer hotline notified
- Email, banking and admin passwords changed from a clean device
- Mailbox forwarding rules and unknown users checked and recorded
- Crime reported to Report Fraud, Police Scotland, IC3 or the FTC as relevant
- Personal data question raised and 72-hour clock noted
- Staff told what to do, and at-risk customers warned by phone
Prepare now so the first hour runs itself
Everything above is easier if you prepare while things are calm. Print a one-page contact sheet with phone numbers for your bank's fraud line, IT provider, insurer hotline and the reporting services above, and keep copies away from your computers. Agree who takes charge if the owner is unavailable. Keep offline or immutable backups that follow the 3-2-1 rule, and test a restore so you know it works. Turn on multi-factor authentication for email and set up alerts for new mailbox forwarding rules.
For a deeper plan covering detection, eradication, recovery and lessons learned, build a full incident response plan, and review our cybersecurity checklist and data backup checklist for the preventive basics. The free small-business guidance from the NCSC in the UK and CISA in the US is also worth an afternoon.
Frequently asked questions
Should I turn off a computer that has been hacked?
Generally, disconnect it from the network but leave it powered on until you have taken advice from your IT provider or incident responder. Powering it off can destroy evidence held in memory, and wiping it destroys the trail of what happened.
Who should I call first after a cyber attack?
If money has been sent to a fraudster, call your bank first, because speed affects whether a payment can be stopped. Otherwise, isolate the affected devices and then call your IT provider and your cyber insurer's hotline.
Do I have to report a cyber attack to the ICO?
Only if it involves a personal data breach that is likely to result in a risk to people's rights and freedoms. In that case, the deadline is 72 hours from when you become aware. Record every breach either way, and check the ICO guidance or call its helpline on 0303 123 1113 if unsure.
Should we pay a ransomware demand to get our files back?
Do not decide in the first hour. Paying does not guarantee recovery and may be illegal if the attackers are sanctioned. Talk to law enforcement and your insurer, and check whether your backups can restore your data first.
Related reading
The bottom line
In the first hour after a cyber attack, your job is not to fix everything. It is to stop the spread, keep the evidence, protect your money and get the right people on the phone. Isolate devices without wiping them, call your bank if funds moved, lock down accounts from a clean device, log every step and report the crime.
Print this checklist today and put the phone numbers on it. When something goes wrong, you will be glad the thinking was already done.
