Suspected cyberattack on our corporate IT system — what concrete steps should we take in the first 24 hours?

Whatever you do, don't make the mistake of rebooting the server. Processes in RAM are the most critical area for tracing the source of the attack. If possible, capture a live memory dump and immediately copy the firewall connection logs to an external, read-only drive.

Where were your backups stored? If they're on a network-attached storage (NAS) unit that's probably compromised too. Do you have backups that are physically air-gapped or stored as immutable copies in a separate cloud account?

Right now, from a clean, non-work machine reset all your corporate email domain admin and cloud control panel passwords enforcing 2FA. Absolutely do not use the infected office machines to change passwords.

We dealt with a similar ransomware incident at our Stuttgart warehouse last year. The incident response team billed 4,800 euros for the first 48 hours, and total costs reached 11,000 euros including the forensics report. Because we had cyber insurance, we got every cent back—if you have a policy, don't waste any time.

Definitely speak with an IT attorney before calling the police. If you panic and make definitive statements to authorities or customers like "our data was stolen," and the investigation reveals that wasn't the case, you'll open yourself up to unnecessary legal liability and reputational damage.

note: I wrote this based on my own experience, it might not apply to everyone.

Handle internal communication on day one following these rules: 1) Absolutely do not use company email or local network chat apps to discuss the incident. 2) Brief your staff via personal phones or a secure, external messaging group. 3) Instruct employees not to click on any suspicious screens and to keep their hands off their computers.

so sorry you're going through this the stress you're feeling right now is completely normal. the most important thing is to stay calm and not reply to any links or email addresses in the ransom note promising payment. honestly don't try negotiating without professional guidance.

Pull the network cables, not the power cord, and don't format any drives until a digital forensics expert examines them.

we need to make a distinction here. the haarder it is to reverse a decision the slower you should make it.

proven by experience.

The discussion got scattered, let me summarize. If you scold false alarms, nobody will report again.

When making decisions, write down the worst-case scenario too, not just the best. If you have questions, write them; I'll answer as best I can.

The answer above hits the nail on the head. If it's your first time, start small; scaling comes later.

This is my opinion I'm not claiming it's absolute truth.

Thanks for posting.

Let me share what happened to me; it might be useful. If 2FA is on, a stolen password alone is useless.

If I were you, I'd go this route.

I felt relieved reading this answer so it's not just me. An untested backup is not a backup.

Just leaving this note, it might be useful.

There's a trap here, let me mention it. Forgotten test environments are more often the entry point than live systems.

Of course it varies if your situation is different.

Absolutely. If I were to add anything: If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Hope this helps.

My perspective changed after experiencing that. Taking measures without an inventory leaves doors you haven't seen open.

This is my opinion, I'm not claiming it's absolute truth.

You're right. Processes without records never improve, because you don't know what to fix.

Proven by experience.