Why the First Hour After a Hack Decides the Damage
If you’re searching for what to do if you get hacked, here is the short answer: isolate the affected device, call your IT provider by phone, lock down accounts from a clean device, write everything down, and report it. That’s the incident response checklist CompuOne walks San Diego businesses through, and this guide covers it minute by minute. We’ve delivered managed IT and cybersecurity services San Diego companies depend on since 1997.
October is Cybersecurity Awareness Month, and most of the advice you’ll see is about prevention: strong passwords, multi-factor authentication, spotting phishing. Our Cybersecurity Awareness Month checklist covers those basics. But prevention fails somewhere eventually, and knowing what to do after a cyber attack matters just as much.
The first hour decides how much data leaves, how long systems stay down, and whether stolen money or your insurance claim can be saved. Here’s the order.
Minutes 0–5: Isolate the Device, Don’t Power It Off
Your instinct will be to shut everything down and delete suspicious files. Resist it. Powering off a machine wipes its memory, and that memory often holds the evidence investigators need to learn how the attacker got in.
Disconnect the device from the network instead. Unplug the ethernet cable and turn off Wi-Fi. The Cybersecurity and Infrastructure Security Agency (CISA) gives the same order in its ransomware response guidance: isolate impacted systems immediately, and power devices down only if you can’t disconnect them, because shutting down loses volatile evidence.
Ransomware does its worst damage when it can hop freely between machines. For more, read our post on why acting fast during a ransomware attack can save your business.
Minutes 5–15: Pick Up the Phone, Not the Inbox
Don’t report the attack from an email account that might be compromised. The attacker may already be reading it. Call your IT provider directly. If you have a managed IT partner, this is the moment 24/7 help desk support earns its keep, because someone answers at 2 a.m. on a Sunday.
If you carry cyber insurance, call your carrier next. Many policies require prompt notice and may require you to use the insurer’s approved response vendors. Bring in an outside company first, or wait too long, and you can put your coverage at risk.
Minutes 15–30: Lock Down Accounts and Stop the Money
From a clean device that wasn’t touched by the incident, reset passwords for affected accounts, starting with email, banking, and anything with administrator rights. Sign out every active session and confirm multi-factor authentication is on. Attackers like to plant hidden email forwarding rules so they keep receiving copies after you change the password, so have your IT team find and delete those.
Picture a bookkeeper who pays a “vendor” invoice after an email announcing new bank details. If that money already left, call your bank right now and request a recall. The FBI’s 2025 Internet Crime Report counted 24,768 business email compromise complaints and more than $3 billion in reported losses. The same report says the FBI’s Recovery Asset Team froze about 58% of the funds it pursued. Speed is the whole game with payment fraud.
Minutes 30–60: Document, Report, and Notify
Write down when you noticed the problem, what you saw, and which systems and people were involved. Photograph ransom notes and error messages. Don’t contact the attackers, and don’t pay a ransom without guidance from your IT team, your insurer, and legal counsel.
With CompuOne’s disaster recovery services, knowing exactly which systems were hit, and when, tells us which backups to restore first.
Notify leadership and tell employees what to watch for, using channels you trust. Report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov. California adds another layer. A business must notify California residents whose unencrypted personal information was, or is reasonably believed to have been, taken, and the California Attorney General requires a sample copy of the notice when one breach affects more than 500 residents. Since January 2026, that notice generally has to go out within 30 calendar days of discovery, so call an attorney early.
Not sure your team could run this on a bad day? Schedule a Free IT Assessment and we’ll walk through it with you.
Choosing Incident Response Services Before You Need Them
The worst time to shop for incident response services is in the middle of an incident. You’re stressed, and your insurer may narrow your choices.
Cost depends mostly on how you buy it. Emergency, call-when-it-breaks help is billed by the hour, and those hours pile up fast during a multi-day recovery. Under a managed cybersecurity services plan, monitoring, isolation, and recovery are planned and budgeted in advance, and your provider already knows your network when the alarm goes off.
When you compare providers, ask four things. Who answers after hours? How fast can you isolate a device remotely? Do you work within cyber insurers’ vendor requirements? Will you help us write a one-page incident response checklist before anything happens? A virtual CIO can own that plan, so your response stays calm and consistent instead of improvised.
Add Home and Hybrid Devices to Your Data Breach Response Plan
With hybrid work, home security is business security. Any laptop or phone that touches company email is part of your network, so it belongs in your data breach response plan. Our work-from-home security service gives remote staff secure access to company files without scattering data across personal devices. For every remote employee, cover these basics:
- Turn on automatic updates for the operating system and apps.
- Use a password manager and enable multi-factor authentication.
- Change the default password on the home Wi-Fi router.
- Back up important files to a location that isn’t always connected.
- Keep work and personal activity on separate devices.
Frequently Asked Questions
What belongs on an incident response checklist?
At minimum: how to isolate an infected device, who to call and in what order (IT provider, insurer, bank, attorney), how to reset accounts from a clean device, what to document, and where to report. Print it with phone numbers on paper, since email and contacts may be unavailable.
What if we don’t have an IT provider yet?
Isolate the device, call your bank if money moved, call your insurer, and report to ic3.gov. Then bring in a managed IT provider that handles incident response, like CompuOne, to contain the problem and plan the recovery.
How much do incident response services cost?
It depends on whether you pay hourly during an emergency or have response built into a managed plan. A managed plan turns that into a predictable monthly cost, and a free assessment shows where your business stands today.
Do you work with businesses outside San Diego?
Yes. CompuOne is headquartered in San Diego and also supports businesses in Chicago and Indianapolis, with 24/7 monitoring and remote support across all three markets.
Ready to Get Started?
A one-page plan, with names and phone numbers written down, turns a chaotic first hour into a calm one. CompuOne has kept San Diego businesses secure since 1997, and we’d be glad to build yours with you.
Schedule a Free IT Assessment or call us at 858-404-7000.