The First Hour After a Cyberattack (Small Business)

If you suspect your business just got hit by ransomware or another cyberattack, the first hour matters. This guide covers what to actually do, based on official CISA guidance.

Three instincts to fight

The natural reaction is usually the wrong one.

Don’t just power it off — Shutting a computer down can destroy evidence stored in its memory.

Don’t pay out of panic — A free way to undo it may already exist; paying doesn’t guarantee anything.

Don’t delete anything — The ransom note and any strange files are evidence, not clutter.

The first hour after a cyberattack, step by step

1Disconnect it, but leave it running

Unplug the network cable, or turn off Wi-Fi, on any affected computer. Leave the power on.

WHAT TO DOThis stops it from spreading to other computers, while keeping evidence intact for whoever investigates.

First hour after a cyberattack: Disconnect it, but leave it running

2Take a breath before you do anything else

Photograph or write down what you’re seeing. Don’t pay a ransom on impulse; a free decryption tool may already exist.

WHAT TO DOCISA and the FBI both discourage paying; it doesn’t guarantee you’ll get your files back.

Take a breath before you do anything else

3Call your IT provider, then report it

Use a phone call or text, not email; your email system might be compromised too.

WHAT TO DOCISA, the FBI’s Internet Crime Complaint Center (IC3), and your cyber insurance carrier (if you have one) should all hear from you.

Call your IT provider, then report it

A few tips

Have a plan before it happens — Decide now who’s in charge and who gets called, not during the panic
Don’t try to fix it yourself — If you’re not sure what you’re doing, you can make it worse or destroy evidence
Keep a written timeline — What you noticed, and when; it helps whoever investigates afterward

Recap: the first hour after a cyberattack

Isolate the computer; disconnect it, don’t power it off
Don’t pay on impulse; document what you’re seeing
Call your IT provider by phone or text, not email
Report it to CISA, the FBI, and your insurance carrier

Printable quick guide

The First Hour After an Attack (1-page quick guide PDF)

Frequently asked questions

Should I turn off a computer that’s been hit by ransomware?

No. Disconnect it from the network instead, by unplugging the network cable or turning off Wi-Fi, but leave the power on. Powering it off can destroy evidence stored in memory.

Should a small business pay a ransomware ransom?

CISA and the FBI both discourage paying. A free decryption tool may already exist for that particular ransomware, and paying doesn’t guarantee you’ll get your files back.

Who should a small business call after a cyberattack?

Your IT provider first, by phone or text rather than email, since email may be compromised too. Then report the incident to CISA, the FBI’s Internet Crime Complaint Center (IC3), and your cyber insurance carrier if you have one.

What should I do with the ransom note or strange files I find?

Keep them. Don’t delete anything; a ransom note and any unfamiliar files are evidence that helps whoever investigates the incident afterward.

The instinct to power off a compromised computer is usually wrong; it can destroy evidence stored in memory. Disconnect it from the network instead, and leave the power on.