We got hacked this morning: what should a step-by-step cyber incident response look like?

If you format it, firewall logs, session records, and the memory dump are gone for good. Copy the server's event logs and web access logs onto a clean USB drive immediately.

Appoint an emergency lead in the company. If the accountant does one thing and the tech guy does another, your coordination will fall apart. Log every action in a notebook with the timestamp, what was done, and who did it.

Reset every employee's email and VPN passwords immediately from a clean device. Check right away if there are any unknown port forwards or active remote desktop rules set up on your office router.

We paid 3,800 EUR to an independent incident response team in a similar case. Within four hours, they found two scheduled tasks the attacker had set up for persistence. If we'd just formatted and restored the backup, we would've been hit again the next night.

An IT guy eager to format is usually just trying to cover up his own mistakes and negligence. Bringing the server back up without knowing the entry point is no different from leaving the front door unlocked for the thief.

so sorry you're dealing with this, walking into something like that in the morning is truly an awful feeling and keep calm and don't rush into restoring a backup and accidentally overwrite yesterday's clean copy.

Your priorities should be: 1) Physically cut the server's internet access. 2) Capture a memory dump and disk image. 3) Find and close the root cause. 4) Restore from a clean backup into a sanitized environment.

Don't shut down the server, just unplug it from the network and don't let anyone touch the format button until you have a bit-by-bit forensic clone of the drive.

quick summary for newcomers: Trying to do this alonne is the most expensive way.

I agree with this. Having backups accessible on the same network and with the same identity makes them part of the target.

Let me summarize the topic, since several different answers were given. Forgotten test environments are more often the entry point than live systems.

I'm also curious if anyone does it differently.

Here's how it went for us. Processes without records never improve because you don't know what to fix.

Proven by experience.

i think it's hard to be that definitive about cyber incident response. honestly your time to detect an issue directly determines its cost.

We got stuck at the same point for a while. Taking notes for two weeks yields better results than a six-month estimate.

If you post the result here, it will help others too.

Same here.

I'm writing this so you don't make the same mistake. Your time to detect an issue directly determines its cost.

If the notification path is long notifications don't arrive; missing notifications mean delayed incident detection. Just leaving this note, it might be useful.

Thanks, this was very helpful. When we decide without measuring, we always end up in the same place.

Your time to detect an issue directly determines its cost.

Thanks, that was the answer I was looking for.