The first hour of a cyberattack: what a small business should do

Most attacks on small businesses start quietly: files that won't open, a password reset you didn't ask for, a client asking about an invoice you never sent. What you do in the next hour affects how much you lose, whether your insurance pays and whether anyone can work out what was taken.

This guide draws on guidance from CISA and the FBI. Print it and keep it somewhere you can find without a computer. And if this is happening to you right now, stop reading and call your IT provider.

First, don't make it worse

• Don't shut everything down. Disconnect affected computers from the network instead: unplug the network cable and turn off Wi-Fi. Shutting down can erase evidence held in memory. CISA recommends powering a device off only if you can't disconnect it from the network.
• Don't wipe, rebuild or "clean up" anything yet. The affected computers, emails and files are evidence.
• Don't contact the attackers or pay a ransom. The FBI doesn't support paying. If the question ever comes up, it's a decision for you, your insurer and an attorney, not something to settle in the first hour.
• Don't discuss the attack over email or Teams if your systems might be compromised. An attacker inside your mailbox can read along. Use phone calls.

If files are locked or you see a ransom note

1. Disconnect the affected computers from the network. If many computers are affected, your IT provider may take the whole office offline.
2. Call your IT provider. Tell them what you saw and when. Take photos of the screen with your phone, including any ransom note.
3. Call your cyber insurance claims line before you hire anyone. Many policies expect you to use their approved response firms and attorneys, and going around them can affect your coverage.
4. Protect your backups. If a backup drive is plugged into an affected computer or the network, disconnect it. Don't restore anything until the cause is found, or you may restore onto a network the attacker still controls.
5. Report it to the FBI at ic3.gov or through the FBI's Phoenix field office. Your insurer or attorney may help with this, but don't skip it.

If an email account is hacked

The signs: sent messages you didn't write, clients getting strange emails from you, replies that disappear, or sign-in alerts you don't recognize.

1. Change the password from a device you trust, then sign the account out everywhere. In Microsoft 365, an admin can block sign-in and revoke all of the account's sessions. A new password alone may not remove an attacker who's already signed in.
2. Check the account's multi-factor authentication methods and remove any phone or app you don't recognize.
3. Look for inbox rules that forward, delete or hide mail, and for apps the account recently gave access to. Attackers add rules so you don't see replies from clients and vendors.
4. Find out what was sent from the account, and call anyone who received a fraudulent message, especially if it involved payment details.
5. Call your IT provider to review the sign-in logs and see what the attacker could reach. If the mailbox held personal information like Social Security numbers or account details, breach notification laws may apply.

If money went to the wrong account

Speed matters more here than anywhere else.

1. Call your bank's fraud department now. Ask them to recall the wire or freeze the transfer.
2. File a complaint at ic3.gov. The FBI works with banks to try to freeze stolen funds, and the odds are better the sooner it hears about it.
3. Then treat it as a hacked email account, whether the account was yours or the vendor's. Here's how these fake payment requests work.

Write things down as you go

Keep a simple log: what you noticed and when, who you called and what they said, which computers were affected and what was done to them. Your insurer, attorney and investigators will all ask for it, and details fade fast.

Write down when you first learned something was wrong. Several notification deadlines are counted from when you discover an incident or determine that a breach happened.

Who to call, in order

If money moved, call your bank first and file at ic3.gov right away, then work down this list.

1. Your IT provider
2. Your cyber insurance claims line
3. An attorney. Your insurer may assign one who handles breaches.
4. The FBI, at ic3.gov or the Phoenix field office

After the first hour

Once things are contained, the work shifts to investigating what happened, restoring from clean backups, resetting passwords and deciding whether anyone has to be notified. That last decision belongs with your attorney, and the rules depend on your business:

• Most Arizona businesses follow Arizona's data breach notification law, with a 45-day deadline.
• SEC-registered advisors follow Regulation S-P, with a 30-day deadline for client notice.
• Medical and dental practices follow the HIPAA Breach Notification Rule.

Get ready before you need this

• A one-page plan, printed, with phone numbers for your IT provider, your insurer's claims line and policy number, your bank's fraud department and an attorney
• Backups an attacker can't reach, with restores tested regularly. Here's how we handle backup and disaster recovery.
• Multi-factor authentication on email and remote access
• 24/7 monitoring, so someone notices an attack that starts at 2 a.m. on a Saturday
• Know what your cyber policy expects before you need it. The insurance questionnaire is a good place to start.

How we help

Our clients call our local team and talk to a technician, any time of day. When something goes wrong, we isolate the affected systems, preserve the evidence, work with your insurer's response team and your attorney, and restore from clean backups. Our cybersecurity services include 24/7 monitoring, so problems can be caught early, even at night or on a weekend.

This article is general guidance, not legal advice.