The First Hour of a Cyber Incident: What to Do, and What Not To

It rarely starts with an alarm.

It starts with someone who can't open a file. A customer asking why you emailed them new bank details. A screen showing a message nobody wants to read. An IT provider calling to ask whether you meant to log in from another country at three in the morning.

What happens in the next sixty minutes decides how bad the next sixty days are. Not because you can fix everything in an hour - you can't - but because the most expensive mistakes are made in that first hour, in a hurry, by well-meaning people trying to help.

Here's what the first hour should look like.

Minutes 0-10: Confirm it, and call the right people

The first job is deciding whether this is real, and who's in charge. Not fixing it.

• One person leads. Someone has to make decisions, and everyone else has to know who that is. If you haven't decided in advance, decide now: usually the most senior person available, with your IT lead or provider beside them.
• Phone, don't email. If email or chat might be compromised, the attacker may be reading it. Use personal mobiles, and a group chat that doesn't run on your company systems.
• Write down what you know. What was seen, by whom, and when. You'll need it later, and memories fade fast under stress.

Minutes 10-30: Contain it - don't clean it

This is where most of the damage is done, and it's usually done by your own people.

The instinct is to clean up: wipe the infected laptop, restore from backup, reset everything and get back to work. Don't. Not yet. Wiping and rebuilding destroys the evidence that the specialists, the insurer and the lawyers will need to work out what happened, how far it spread, and whether any data was taken.

Instead:

• Disconnect affected devices from the network. Unplug the cable, turn off the Wi-Fi. Leave them switched on unless a specialist tells you otherwise; some evidence only exists while the machine is running.
• Disable accounts that may be compromised, and sign them out everywhere. If it's an email account, check for forwarding rules the attacker may have added.
• If money is involved, call the bank now. A fraudulent payment can sometimes be recalled if you're fast. Hours matter.
• Check your backups aren't next. Ransomware often goes after backups first. If one copy is kept offline or locked against changes, make sure it stays that way.

Minutes 30-45: Call the insurer before the cavalry

If you have cyber insurance, call their incident line before you bring in outside help.

Many policies only pay for specialists the insurer has approved, and some require you to call within a set time. Bring in your own team first and you can end up paying for the response yourself. The insurer will usually connect you with an incident response firm and a lawyer, and on the worst day of your year that's exactly what you want.

No insurance? Call a specialist incident response firm anyway. This isn't a job for your regular IT support on their own, however good they are.

Minutes 45-60: Start the log, and tell people what they need to know

Start a log. Times, what happened, what was decided, and by whom. One person keeps it. It's the record for the insurer, the lawyers and, later, the review - and it stops the same decision being argued about twice.

Tell your staff something. They already know something's wrong. Tell them what they need to know: what not to use, what not to email about, who to call if they see anything odd, and when they'll hear more. Ask them not to discuss it outside the company or on social media.

Hold off on customers - but not for long. Don't speculate about causes or blame, and don't promise anything you can't keep. But if customers are affected, or might be emailed by the attacker, they need to hear from you before they hear about it some other way. Your lawyer will help with what you're required to tell them, and by when; some deadlines are only days.

The mistakes that make it worse

• Wiping and rebuilding too soon. It feels like progress. It destroys the evidence.
• Talking about it over email that the attacker may be reading.
• Everyone fixing at once. Five people changing things in parallel, with nobody writing it down.
• Paying a ransom quickly to make it go away. Some payments break sanctions laws, payment doesn't guarantee you get your data back, and it marks you as someone who pays. If it's even being considered, it's a decision for leadership, with legal advice.
• Going quiet. Silence gets filled with rumor, and the rumor is usually worse than the truth.

What to do this week, before you need it

You can't prevent every incident. You can make the first hour calm instead of chaotic, and most of it takes an afternoon:

1. Decide who leads, and who stands in if they're away.
2. Find your insurer's incident line, and check what the policy requires of you.
3. Write down the numbers you'd need - IT lead, insurer, bank fraud line, lawyer - and keep a printed copy somewhere that won't be encrypted with everything else.
4. Agree how you'd talk if email were down.
5. Practice it once, for thirty minutes around a table. You'll find the gaps while finding them is cheap.

The bottom line

The companies that come through an incident well aren't the ones that never get hit. They're the ones that knew, before it happened, who would decide, who they'd call, and what not to touch.

The first hour isn't about fixing it. It's about not making it worse.

Want it written down before you need it? The Incident Response Plan is an editable plan for who decides, who calls whom, and the first hour step by step - with a guide to filling it in and practicing it.

Free guide: The 45-Minute Tech Spend Checkup - a one-page meeting agenda for finding out whether your technology spending is working.

Related reading

• The Security Questions Every Executive Should Be Able to Answer
• Every Organization Has a Sarah (And Why That's a Problem)

Not sure how your team would handle the first hour? Let's talk. A short rehearsal now is far cheaper than finding the gaps on the day.