Incident first steps
Think you have been compromised?
Here is what to do now.
If you think your business has been hacked, call ACS Cyber’s 24/7 incident line at 1-650-300-7557. You do not need to be a client. The short version: isolate affected devices from the network, keep the evidence, do not wipe or restore anything yet, and protect any money at risk. We can talk you through each step on the call.
01
Call for help first
Call our 24/7 incident line, or your IT provider, before you clean up, restore or reset anything. If you have cyber insurance, call its claims or breach hotline early too: many policies require prompt notice or approved responders.
02
Isolate, do not power off
Disconnect affected devices from the network by unplugging the cable or turning off Wi-Fi. Leave them powered on unless we advise otherwise, because memory can hold useful evidence.
03
Do not clean up yet
Do not wipe, reimage or restore devices, and do not delete suspicious emails, files or accounts. Photograph or note what you see, and leave it in place for now.
04
Switch to the phone
Attackers may be able to read your email and chat. Coordinate by phone, or from a device and account you know are clean.
05
Protect the money
If a payment may have gone to a criminal, call your bank’s fraud department now and ask about a recall. Use a number from the bank’s website or your card, never one from an email.
- A ransom note or encrypted files
- Sign-ins you do not recognize
- A fraudulent payment request or changed bank details
- Contacts receiving odd emails from you
- Disabled security tools or unfamiliar programs
- Data posted online or an extortion message
Not a client yet? You can still call. Our incident line is answered 24/7 for organizations nationwide. Not sure whether you have been compromised? Check the warning signs.
The full checklist
Step by step: what to do, in order
Work through these steps in order, although several often happen at the same time. If our team, your insurer or your counsel advises differently, follow their direction. If this is happening now, call first and keep this page open while we talk.
01
Stay calm and call for help
Call our 24/7 incident line at 1-650-300-7557, and your IT provider if you have one. Calm, deliberate steps protect your options. Hurried ones, such as wiping a laptop, can remove the evidence you need later. You do not need to be a client to call.
02
Notify your insurer early, and bring in breach counsel
If you have cyber insurance, call your insurer’s claims line or breach hotline as soon as you can, ideally before outside responders start work or costs are incurred. Many policies set notice requirements, and some require approved response firms or the carrier’s consent first. We work alongside insurer-assigned response firms where your policy permits. Involve breach counsel too, so notification and communication decisions are made with legal advice.
03
Contain without destroying evidence
Disconnect affected devices from the network by unplugging the cable or turning off Wi-Fi. If backup systems are still reachable, disconnect them too. Leave devices powered on, and do not wipe them, unless responders advise otherwise. Shutting down can erase evidence held in memory.
04
Start an incident log
Write down what you noticed, when, and who found it, then every action taken since, with the time and who took it. Keep the log on paper or on a device you know is clean. It lets responders, your insurer and your counsel work from the same facts.
05
Preserve the evidence
Photograph screens, error messages and ransom notes. Do not delete logs, suspicious emails, inbox rules or unfamiliar accounts. Responders can help you disable anything that needs shutting off without destroying evidence. Some logs are kept only for a limited time, so ask your IT provider or responders to save copies early.
06
Secure accounts, in step with your responders
From a clean device, reset passwords for affected accounts, sign them out of all sessions and remove MFA methods you do not recognize, noting what you find first. Agree the timing with your responders. A reset made before every way back in is found can tip off attackers who still have access.
07
Protect your finances
If a payment may have gone to a criminal, call your bank’s fraud department and ask about a recall. Hold pending changes to payment details, and verify any new or changed bank details by phone, using a number you already have on file.
08
Report it to law enforcement
With your counsel’s input, report the incident to the FBI Internet Crime Complaint Center (IC3) or to CISA. If money was sent, file with IC3 promptly and include the transaction details. Prompt reports give banks and law enforcement more chance to act.
09
Communicate carefully
Tell staff what they need to know to work safely, and no more. Hold public statements and customer notices until the facts are established and your counsel has reviewed them. Keep incident conversations on the phone while the incident is open.
10
Recover, then strengthen
Restore systems only after the threat is contained and you know how the attackers got in, so you do not restore their access along with your data. Use clean backups or clean rebuilds, checked before use. Then close the remaining gaps, so it is less likely to happen again.
At a glance
Do this, and avoid this
A quick reference for the first steps after a suspected compromise. If our team, your insurer or your counsel advises differently, follow their direction.
| Do this | Avoid this |
|---|---|
| Disconnect affected devices from the network | Powering off, wiping or reimaging devices before evidence is collected |
| Call for help before you clean up, restore or reset anything | Running cleanups, restores or rebuilds before responders have looked |
| Preserve suspicious emails, files, inbox rules, accounts and logs | Deleting evidence to tidy up |
| Reset passwords from a clean device, in step with your responders | Resetting from the affected computer, or assuming a password change locked the attacker out |
| Call your bank’s fraud line if a payment may have gone to a criminal | Waiting to finish an internal review before calling the bank |
| Coordinate by phone or from devices you know are clean | Discussing the incident over email or chat the attackers may be watching |
| Notify your insurer early and involve breach counsel | Hiring vendors or incurring costs before checking your policy’s requirements |
| Leave any ransom decision to leadership, with counsel, insurer and law-enforcement input | Contacting, negotiating with or paying the attackers on your own |
Before you call
Have this ready when you call
You do not need all of this before you call. Share what you have, and we will work through the rest together. Please do not send passwords, logs or files to anyone by email or chat, including us. Once we are engaged, we arrange secure evidence handling.
- Your name, organization and a callback number
- What you noticed, and when you first noticed it
- Which systems, devices and accounts seem affected
- What has been done so far, and by whom
- Who inside and outside the organization has been told
- Your cyber-insurance carrier and policy details, if you have them
- Your IT provider’s contact details
- Details of any payment involved, such as the date, amount and bank it was sent from
Ready to call? Our incident line is answered 24/7.
Speak with our incident team at 1-650-300-7557. You do not need every detail above before you call, and you do not need to be a client. We can talk you through safe first steps on the call.
When you call
What happens when you call ACS Cyber
Triage on the phone. A member of our incident team talks through what you are seeing, helps you decide on safe first actions and agrees next steps with someone authorized to approve them. We discuss scope and costs with a decision maker before work begins.
Containment. We guide you through isolating affected devices, accounts and connections in a safe order, preserving evidence as we go. For clients on our managed detection and response service, SOC analysts can take pre-approved containment actions under rules agreed in advance.
Investigation. Our in-house forensic investigators work to establish how the attackers got in, what they accessed and whether they are still there, with documented evidence handling and chain of custody. How we find out what happened
Coordination. When you authorize it, we coordinate with your insurer and breach counsel, and we work alongside insurer-assigned response firms where your policy permits. We give counsel the facts. We do not provide legal advice.
Recovery and hardening. We help you restore systems in a controlled order, checked before use, and close the gaps that let the attackers in. Where systems need a clean rebuild, Atlantic Computer Systems, our parent company, provides managed IT and can carry out rebuilds of servers, endpoints, Microsoft 365 and networks. Recovery and preventing a repeat
On the first call, we help you
- Understand what is happening
- Decide on safe first actions
- Avoid steps that destroy evidence
- Know who else to involve: your insurer, counsel, bank and IT provider
- Agree on next steps and who approves them
Your situation
Guidance for your situation
Each guide covers a specific situation: first steps, what we do and how to help prevent a repeat. Choose the one closest to what you are seeing.
Ransomware
Encrypted files, a ransom note or systems that suddenly will not start.
Business Email Compromise and wire fraud
A fraudulent invoice was paid, bank details were changed or a trusted mailbox sent payment requests.
Phishing and hacked Microsoft 365 accounts
Someone clicked a link, entered a password or approved an MFA prompt, and an email account is behaving oddly.
Data breach or exposure
Customer, patient, employee or financial records may have been accessed, copied or shared.
Find out what happened
The immediate danger has passed, and you need to know how the attackers got in and what they touched.
Recover and prevent a repeat
The attack is contained. You need a clean recovery and stronger defenses to reduce the chance it happens again.
Not sure what you are seeing?
If nothing urgent is happening but something does not look right, or the incident is over and you want a plan, book a free 30-minute consultation with a cybersecurity expert. We will help you make sense of it and choose a sensible next step. If you see signs of an active attack, call 1-650-300-7557 instead.
Prevention
Stop it from happening again
Once the incident is behind you, the next job is closing the gaps that let it happen and catching the next attempt earlier. Our team can help you build ongoing protection. Read more about recovering and preventing a repeat.
24/7 managed detection and response
Our in-house SOC analysts monitor your endpoints, Microsoft 365 or Google Workspace, Azure and AWS, firewalls and servers around the clock, and investigate what they find. ACS supplies and manages the EDR agent.
Security awareness training
Phishing simulations and practical training help your people recognize phishing, payment fraud and impersonation, and report it.
Vulnerability management and penetration testing
Regular scanning, prioritized remediation and in-house penetration testing help find and fix the weaknesses attackers look for.
Advisory, vCISO and incident-response planning
A security roadmap, a written incident-response plan and tabletop exercises, so key decisions are made before the next incident, not during it.
FAQ
Questions people ask when they think they have been hacked
Call for help, and isolate affected devices from the network without powering them off. Leave the evidence in place, do not wipe or restore anything yet and move conversations to the phone in case attackers can read your email. If money may have gone to a criminal, call your bank’s fraud department.
ACS Cyber’s 24/7 incident line is 1-650-300-7557, and our team can talk you through first steps on the call.
Warning signs include sign-ins you do not recognize, MFA prompts nobody requested, new inbox rules or forwarding, disabled security tools, unfamiliar programs or accounts, and encrypted or renamed files. Our guide on how to tell if you have been compromised explains what each sign can mean and how to check. If you see signs of an active attack, call us.
Usually not. Disconnect it from the network instead, by unplugging the network cable or turning off Wi-Fi, and leave it powered on. Shutting it down can erase evidence held in memory that helps show what the attackers did. If something is actively spreading and you cannot disconnect it, call us and we will advise.
That decision belongs to your leadership, made with legal counsel, your insurer and input from law enforcement. Payment raises legal questions, including sanctions considerations, and does not assure that files can be decrypted or stolen data deleted. We help you understand your recovery options so the decision is an informed one. See our ransomware response page for first steps.
Change them soon, but carefully. Reset from a clean device, sign accounts out of all sessions and agree the timing with your responders. A password change alone may not end an attacker’s session, and a reset made before every way back in is found can tip off attackers who still have access.
From a clean device, reset the password and sign the account out of all sessions. Then note, and remove, any MFA methods, inbox rules or forwarding you do not recognize, and warn your finance team to confirm by phone any payment request sent from that mailbox. Our hacked account guide covers each step for Microsoft 365 and Google Workspace.
If you have cyber insurance, notify your carrier early. Many policies set notice requirements, and some require approved response firms or the carrier’s consent before costs are incurred, so check your policy before you hire vendors. We coordinate with your insurer when you authorize it, and we work alongside insurer-assigned response firms where your policy permits.
You can report to the FBI Internet Crime Complaint Center (IC3) or to CISA. If money was sent, file with IC3 promptly and include the transaction details. Your legal counsel can tell you whether any other reporting or notification is required for your organization, based on what was affected. We can provide the technical details a report needs.
Yes. Our 24/7 incident line at 1-650-300-7557 is open to organizations nationwide, whether or not they are clients. We help with first steps on the call and discuss scope with an authorized decision maker before any engagement begins. If you already work with an IT provider, we can work alongside them.
24/7 incident line
Think you have been compromised? Talk to us now.
Call 1-650-300-7557 to speak with our incident team, day or night. Not a client? You can still call. If nothing urgent is happening and you want a second opinion or a plan, book a free 30-minute consultation. For an overview of how we help, see help after any compromise.