Somebody forwards you an email your company appears to have sent and did not. A supplier says they were told to change your bank details. A member of staff mentions their password stopped working, twice. Something is wrong and you are not yet sure what.
What happens in the next hour decides how much of this you will be able to reconstruct afterwards. And most of the damage in that hour is not done by the attacker. It is done by helpful people tidying up.
Stop doing these first
Do not delete anything. Not the suspicious email, not the rule you found in the mailbox, not the strange file. Those are the record of what happened. Deleting them is the digital equivalent of mopping the floor before anyone photographs it.
Do not wipe or rebuild the machine. The instinct to get someone working again is a good instinct on any other day. Today the machine is the evidence, and rebuilding it destroys the only copy of how they got in, which is the thing that stops it happening again next month.
Do not warn the whole company by email. If an account is compromised, the attacker is reading that email too, and you have just told them you are onto them. Use the phone, or walk down the corridor.
Do not pay anything, change any bank detail, or approve any invoice until this is resolved, no matter how routine it looks or how senior the person asking appears to be.
Then do these, in this order
1. Contain without destroying
There is a real difference between isolating and erasing. Disconnect the machine from the network, and leave it powered on. Suspend the suspect account rather than deleting it. Both stop the bleeding while keeping everything a proper look would need.
2. Reset credentials, in the right order
Administrators first, then the accounts you suspect, then anything sharing a password with either. Revoke active sessions and tokens as well as changing passwords: a session already open does not care that the password changed. If multi-factor was not on, turning it on now is part of containment, not a project for later.
3. Look for what they left behind
Attackers who get into a mailbox almost always set up a way to keep watching or to stay hidden: a forwarding rule to an outside address, a rule that files anything mentioning "invoice" or "payment" straight into a folder nobody reads, a mail app authorised months ago, an added recovery phone number. Find them before you congratulate yourself on the password reset.
4. Write down what you know, with times
Plain notes, as you go. What was noticed, by whom, at what time, and what you did about it. Contemporaneous notes are worth enormously more later than a reconstruction from memory, and every insurer, lawyer and regulator will ask for exactly this.
5. Make the calls
In this order
- Your IT provider, by telephone, not email.
- Your insurer or broker. Most cyber policies require prompt notification and many provide an incident response team as part of the cover, which you are paying for whether you use it or not.
- Your attorney, particularly if money moved or personal data may be involved. Work done at their direction may be treated differently, and that decision has to be made at the start, not afterwards.
- Your bank, immediately, if any payment or bank detail is involved. Hours matter for recovery.
- The FBI's IC3 at ic3.gov for wire fraud. Fast reporting is occasionally the difference between a recovered transfer and a lost one.
6. Decide who needs telling, and take advice before you do
Notification obligations depend on what data was involved and what industry you are in. This is a question for your attorney, and it is a separate question from whether telling people is the decent thing to do. Get the legal answer before you send anything, because the first version of a notice tends to be the one that gets quoted back.
What you will wish you had done beforehand
Nobody reads a plan for the first time during an incident. What actually helps, in our experience, is very small:
- A printed page with the phone numbers on it: IT, insurer and policy number, attorney, bank, building. On paper, because the network is the thing that is broken.
- One named person who is allowed to say "this is an incident" so that nobody spends the first hour waiting for permission.
- Logging that goes back far enough to answer questions. Many mailbox audit logs default to a short retention, and a ninety-day question cannot be answered by a thirty-day log.
- A tested restore, so recovery is a known quantity rather than an experiment.
If you take one thing from this page: isolate, do not erase. Almost everything else can be fixed later. Evidence cannot be recreated once it is gone, and it is the difference between knowing what happened and guessing about it forever.
How we handle it
For our managed clients, the containment steps above are ours to run and the audit record already exists, because every action our tooling takes is logged in a way that cannot be quietly edited afterwards. Where something needs reconstructing across a mailbox rather than a machine, that is a separate and deliberately discreet piece of work, run under the direction of you and your attorney.
Something happening right now?
Call rather than email, especially if you think a mailbox is involved. If it turns out to be nothing, we will tell you it is nothing, and that is a good outcome.
Call 808-451-3630This is practical guidance, not legal advice. Notification duties and the handling of evidence vary, and your attorney's instruction governs.