Wondering what to do after a cyberattack? Unplug affected devices from the network (don’t power them off if you can avoid it), call your managed IT provider by phone, keep all evidence, and contact your bank immediately if money was sent. This guide walks you through the steps and shows where to report incidents in the US, UK, and Australia.
If your company is hit, the first hour counts. It’s also when rushed choices can make things worse—like shutting down the wrong machine, erasing clues, or emailing from an inbox an attacker can still see. The steps below give you a clear plan you can follow without technical know‑how. For offices around Panama City and Bay County, these are the same first moves we coach clients to take.
First moves: avoid making the situation worse
- Avoid powering off the impacted computer if you can. It’s safer to disconnect it from the network. Turning it off may wipe valuable evidence in memory.
- Don’t delete anything. Keep the ransom note, the suspicious message, and any alerts. Your IT team and investigators will need them.
- Do not rush to pay any ransom.
- Don’t discuss the incident using a compromised account. If an attacker is inside your email, they can read your messages. Use phone calls or a different, known‑safe account instead.
What to do after a cyberattack: the steps
Work through these in order as soon as you spot trouble.
- Isolate anything that looks compromised. Pull the Ethernet cable and disable Wi‑Fi on any affected computers or devices. That helps contain the issue and protects other systems and backups. Federal guidance recommends isolating over shutting down; only power off if there’s no other way to take the device off the network.
- Call your managed IT provider right away—use the phone, not email. If you carry cyber insurance, notify them next; many policies require you to involve their incident team early.
- Preserve the evidence. Don’t wipe or rebuild machines yet. Screenshots can help, but keep the originals in place for your IT team and law enforcement.
- If funds were sent, contact your bank immediately. Ask whether they can recall or freeze the transfer. With wire and bank fraud, acting within hours matters most. The FBI notes that if you report a business email compromise to IC3 within 72 hours, its Recovery Asset Team has the best chance to pull funds back and succeeds in about 70% of timely cases.
- From a clean computer, change passwords and turn on two‑step login. Start with email and any administrator logins. Two‑step login (also called multi‑factor authentication) blocks many follow‑on attacks.
- Report the incident. Reporting can help recovery, and in some cases it’s required by law. See where to file below.
Where and how to report an incident
Report in the country where your business operates:
- United States: Submit a complaint to the FBI’s Internet Crime Complaint Center (IC3), and notify CISA as well.
- United Kingdom: Use the NCSC reporting service, and also file with Action Fraud.
- Australia: Report via ReportCyber, or call the 24/7 hotline at 1300 CYBER1.
If money was wired to a scammer, act fast. The FBI advises that quick reporting to IC3—ideally within 72 hours—gives its Recovery Asset Team the best chance to recover funds, with successful clawbacks in about 70% of timely reports.
If personal data about customers or staff may have been exposed, you might need to notify regulators and affected people, sometimes within 72 hours. Rules vary by location—think GDPR across the UK and Europe, state breach‑notification laws in the US, and Australia’s Notifiable Data Breaches scheme. Check with your attorney and your managed IT provider early so you don’t miss a deadline.
Should you pay a ransom?
When ransomware strikes, this question comes up fast. The FBI advises against paying. There’s no guarantee you’ll get working decryption keys, paying can make you a future target, and it funds criminal activity. Treat this as a decision made together with law enforcement, your IT or incident‑response professionals, and your insurer—never alone in the first frantic hour. In some cases, a no‑cost decryptor already exists for the exact strain, which is another reason to get experts involved before sending any money.
A little planning goes a long way
Response is much smoother if you prepare a simple one‑page plan in advance. Include:
- Priority contacts—your managed IT provider and your insurance contacts—with phone numbers saved somewhere you can access even if your main systems are down.
- Where your backups live and proof you’ve recently tested a restore, not just that the backups ran.
- Your most critical systems, devices, and accounts, so you know what to secure and restore first.
For most small businesses, that single page is enough to cut down the scrambling if the day ever comes.
Frequently asked questions
What should I do first during a cyberattack?
Take the affected computer or device off the network right away by unplugging the network cable and turning off its wireless connection. Then call your IT provider by phone. Getting it isolated keeps the problem from spreading while help is on the way.
If ransomware pops up, should I shut down the computer?
If possible, disconnect it from the network instead of powering it off. Shutting down can erase useful clues stored in memory. Only switch it off if there’s no other way to take it offline.
Is paying the ransom a good idea?
Generally, no. The FBI does not recommend paying. There’s no promise your data will be restored, and paying encourages more attacks. Make this call together with law enforcement, incident‑response pros, and your insurer—and first check whether a legitimate, free decryptor exists for that ransomware family.
We sent a wire to a scammer—now what?
Call your bank at once and request a recall or hold on the transfer. In the US, file quickly with the FBI’s IC3—ideally within 72 hours—so their Recovery Asset Team can try to claw funds back. In other countries, act immediately with your bank and your national cyber reporting service.
Who should I report a cyberattack to?
In the US, report to the FBI’s IC3 and notify CISA. In the UK, report through the NCSC service and Action Fraud. In Australia, use ReportCyber. Also inform your cyber insurer, and confirm whether privacy or breach laws require notifying a regulator if personal data was involved.
If you need help building a simple response plan or you’re facing an active issue, we’re here for businesses across Bay County—get in touch.
—
