We just got hacked: what should we do in the first hour of a cyberattack?

Pulling the plug is the biggest mistake you can make. The attacker may have left in-memory malware sitting in volatile RAM. Disable network adapters, pull the ethernet cable, cut internal access at the router, but leave the machine powered on.

Stop whoever wants to plug in the backup drive right now. The first-hour rule is simple: contain the spread first, assess the damage second. Unplug network cables and contact an outside cybersecurity specialist using a clean mobile connection.

Stay calm; decisions made in panic cause more damage than the attack itself. Don't blast out a general breach announcement via email or messaging right away. First, assess the situation to figure out whether data was exfiltrated or just locally encrypted.

exact same thing happened at our warehouse in lyon two years ago but i mean the accountant plugged the backup right in, within five minutes the backup drive got locked too. do not touch that drive keep it in a separate safe.

Was your system running entirely on a local server, or did you have cloud email and file integrations? Also, did you have an open remote desktop port exposed to the internet?

Under French regulations, if systems containing customer or employee data are affected, you must file an official notification via the CNIL platform. Filing a report with the local police or gendarmerie cybercrime unit is also mandatory for any subsequent insurance claims.

Follow these three steps in order: 1) Physically pull the Ethernet cables from all office computers and turn off Wi-Fi. 2) Copy gateway and router access logs to a secure external flash drive. 3) Take photos of locked screens, noting the timestamp and device tag for each.

Don't delete any files don't connect the external drive to the network, and call in professional external digital forensics support immediately.

Same here.

Let me share my experience. Trying to do this alone is the most expensive way.

If you post the result here, it will help others too.

it's rare to find an explanation this clear. having backups accessible on the same network and with the same identity makes them part of the target.

everyone rushing into cyberattack what to do gets stuck at the same point but that's all sorry if I went on too long.

i'd appreciate it if you shared the outcome.

My questions are cleared up, thanks.

Thanks a lot, I'll try it today. Just because everyone does it doesn't mean it's right.

This thread is archived.

Thanks for writing this that's the right way. When making a decision first look at what data you have on hand.

Noted thanks.

You're right, I've been down that road too. Taking notes for two weeks yields better results than a six-month estimate.

Correct me if I'm wrong.