What To Do After A Cyber Incident

Step 1. The First Thirty Minutes: Do Not Start Cleaning

The instinct when something goes wrong is to fix it immediately. Delete the strange files. Run a virus scan. Reinstall everything and hope it goes away.

Do not do any of that yet. Cleaning up destroys the evidence that tells you what happened, what was taken, and whether it is still happening. Your insurer and any professional you bring in will need that evidence, and it cannot be recovered once it is gone.

Your first job is to stop the bleeding and take notes. Not to tidy up.

Step 2. Disconnect It, Do Not Turn It Off

This distinction is the most useful thing in this guide. Read it twice.

• •Pulling the network cable, or switching off the Wi-Fi, separates the machine from the attacker and stops data leaving.
• •Shutting the computer down destroys what is held in its memory, and can alter files on the disk.

So disconnect from the network, and leave the machine powered on and untouched. Do not restart it. Do not let it go to sleep.

Step 3. Write Down What You Saw, Immediately

Memory fades fast, and the timeline of an incident matters. What feels unforgettable right now will be fuzzy by tomorrow.

Write down, on paper or on another device you trust:

• •What you noticed, and when you noticed it.
• •What you were doing at the time.
• •Any error messages or popups, in the words they used.
• •What you have done since, including anything you clicked or closed.

A chronologically ordered list written straight away is worth far more than a recollection reconstructed later, however confident that recollection feels.

Step 4. Note The Evidence Worth Keeping

In plain terms, these are the things that matter:

• •Unusual emails sent from your account.
• •Files that appeared or vanished.
• •A ransom note or demand.
• •Unusual login alerts, especially from places you have never been.
• •Any device behaving oddly, running slowly, or making noise when idle.

Take photos of screens with your phone before anything changes on them. You do not need to analyse any of this. You only need to preserve it, so that someone who can analyse it has something to work with.

Step 5. Work Out The Scope, Calmly

Ask yourself a short set of practical questions. The answers decide who you must call, and how quickly.

1. 1.Which accounts or machines are involved?
2. 2.Is any money involved, and can you contact the bank now?
3. 3.Is customer or client data affected? This may trigger a legal duty to report.
4. 4.Are other devices on the same network also affected?

Knowing the scope is what tells you whether this is a quiet morning's work or something that needs outside help today.

Step 6. Who To Call, And In What Order

Work down this list in order. The first item is first for a reason.

1. 1.Your bank, immediately, if money or payment details are involved.
2. 2.Your insurer. Most policies include cyber cover and have a helpline.
3. 3.Your IT support, or a professional, if you have one.
4. 4.For a business, the UK National Cyber Security Centre's reporting service.

If personal data about customers has been affected, there may be a legal obligation to report the breach to the Information Commissioner's Office within 72 hours. That is a reason to seek advice quickly. It is not a reason to panic, and the clock starting does not mean the situation is hopeless.

Step 7. Recovery And What To Do Differently

Recovery is calm and ordered. Restore from a backup you know is clean, and only after the cause is understood. If you restore before you understand how it happened, it will happen again, often within days.

Then change your passwords from a different, unaffected device. Start with email, because it is the key to everything else. Almost every other account can be reset through it.

Finally, the honest reflection. Almost every incident traces back to one of a small handful of causes: a reused password, a missed update, a clicked link, or an account with no second factor. Working out which one it was for you is the real lesson from the whole episode.

Tips

• •Disconnecting is not the same as shutting down, and the difference matters.
• •Write the timeline immediately, while you still remember it.
• •Photos of your screen are legitimate evidence.
• •Your insurer usually has a cyber helpline and most people never think to call it.
• •Change your email password first, from a different device.
• •Restore only after you understand the cause, or it will happen again.