Hosting provider says "you've been hacked" — what are the incident response steps for the first hour?

Tell your developer to step away from the keyboard immediately. The urge to "clean up fishy files" is an amateur reflex that obliterates forensic evidence. Any cleanup done before finding every persistence mechanism and backdoor left behind is just an illusion of security.

Virtually pull the network plug from the cloud panel, but leave the box powered on. Dump network socket states, active process trees, and open file descriptors to an external mount via the console. Any malware running solely in volatile memory vanishes the second the OS reboots.

Immediately rotate all external API keys, database credentials, and server access keys from an entirely clean, off-network device. Never trigger these credential resets from inside the compromised machine itself.

Got an identical alert last year, panicked, wiped the box, and restored from backup. Because we never uncovered the actual point of entry, we got hit with a 45.000 SAR ransom note two days later and had to cough up another 60.000 SAR for digital forensics anyway. Don't touch a thing without preserving evidence first.

Just because the hosting provider says "you've been hacked" doesn't always mean an attacker is actively inside. Sometimes a misconfigured DNS service or an open SMTP relay on the server triggers these alarms too. Cut off the network connection, but don't jump to conclusions and condemn the system right away.

Here is the order of operations for the first 60 minutes: 1) Cut the server's external internet access. 2) Take a RAM dump and a disk snapshot. 3) Change admin passwords from an independent device. 4) Request abnormal traffic logs in writing from the hosting provider. 5) Officially notify company management and legal counsel.

Legal obligations come into play simultaneously with the technical interventions carried out during a cyber incident. In the event of a suspected personal data breach, notification obligations to the relevant national regulatory bodies and affected users may arise; therefore, it is essential that all technical steps be thoroughly documented as they are executed.

so sorry to hear that I can only imagine the tension in the office riht now. stay calm and stop pointing fingers at each other. the priority shouldn't be rushing to bring the system back online, but figuring out the source of the attack and patching it permanently.

theres a part I dont understand. btw if its your first time, start small; scaling comes later.

if you post the result here, it will help others too.

How did you solve this? Forgotten test environments are more often the entry point than live systems.

Just leaving this note, it might be useful.

I'm a small business, let me explain from my side. If you get three different answers on a topic, the question was asked wrong.

Proven by experience.

You're right, I've been down that road too. When you try to change everything at once, nothing settles.

If you're going this route, sort this out first. Mistakes made on the incident response steps side are usually reversible but expensive.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. Hope this helps.

I went through the same thing. Everyone rushing into incident response steps gets stuck at the same point.

Correct me if I'm wrong.

here's how it went for us. when making decisions, write down the worst-case scenario too, not just the best.

I agree. If you scold false alarms, nobody will report again.

Good luck with that.

The most overlooked point about incident response steps is this: Processes without records never improve, because you don't know what to fix.

When you try to change everything at once, nothing settles. Proven by experience.