What to Do If Your Business Gets Hacked
Disconnect the affected device from the network, but do not turn it off. Then call for help before you touch anything else.
Those two instructions cover most of what businesses get wrong in the first hour. Powering down destroys evidence held in memory. Leaving the machine connected lets whatever is happening continue spreading.
The First Hour
- Disconnect, do not power off. Pull the network cable or turn off the wifi on the affected machine. Leave it running.
- Call your IT provider immediately, before investigating yourself. Well-meant poking around destroys the evidence needed to work out what was accessed.
- Do not pay anything, and do not reply to the attacker, until you have advice.
- Write down what you know: what was seen, when, by whom, and what has been done since. Memory degrades fast and this record matters later.
- Change passwords from a different, clean device, starting with email and any administrator accounts. Changing them from the compromised machine achieves nothing.
- Tell your insurer early. Most cyber policies include incident response and require prompt notification. Delaying can affect coverage.
What Not to Do
Do not wipe and reinstall straight away. It is the instinct, and it destroys any ability to determine what was taken. That question drives your legal obligations.
Do not keep quiet internally. If one person has been compromised, others are likely being targeted the same way. Warn staff.
Do not assume it is finished because the obvious symptom stopped. Attackers commonly dwell in an environment for weeks. The visible event is often late in the sequence, not the start of it.
The Question That Decides What Happens Next
What was accessed?
Everything downstream depends on it. If personal information about customers or staff was involved, PIPEDA obligations apply and a breach posing a real risk of significant harm must be reported. The Office of the Privacy Commissioner publishes guidance on what that means in practice.
Answering it properly is specialist forensic work, and it is the part most commonly covered by a cyber insurance policy. It is also the part that becomes impossible if the machine was wiped in the first twenty minutes.
Honestly, You Should Not Be the One Noticing
Here is the part most articles on this topic leave out.
If a client of ours is on the full monitoring and managed detection stack, they will almost certainly not be the one who discovers a compromise. The security operations centre sees the anomaly, alerts us, and we are phoning them. Their first involvement is a call explaining what has happened and what has already been contained.
That is the real measure of whether your security arrangement is working. Not whether you have a response plan, but whether you would be the one executing it or the one being briefed.
If your honest answer is that somebody in your office would eventually notice something odd, that is the gap. Everything above is still worth knowing. It is just the wrong end of the problem to be solving.
Before Anything Happens
The short list that makes a bad day survivable:
- Know who to call, and have the number somewhere that does not depend on your network
- Know whether you have cyber insurance and what it requires of you
- Have backups you have actually restored from, held where ransomware cannot reach them
- Have monitoring, so the clock starts in hours rather than weeks
- Have decided in advance who speaks to staff and clients
None of this takes long. All of it is far cheaper before than during.
What Should You Do If You Think Your Business Has Been Hacked?
Act quickly, but do not panic. Contact your IT or cybersecurity provider, contain the incident appropriately, preserve evidence, secure critical accounts, and determine the scope of the compromise. Once the immediate threat is addressed, focus on safe recovery and understanding how the attack happened.
At Digital Sky Solutions, we help businesses in Victoria, Vancouver, and across British Columbia strengthen their IT environments and prepare for cybersecurity incidents before they become emergencies.
Our cybersecurity and managed IT services help businesses put practical safeguards, monitoring, planning, and IT support in place.
If you are unsure how prepared your business would be for a cyberattack, contact us today. We can help you assess your IT environment, identify areas of risk, and develop a practical plan to improve your resilience.
Related Posts:
- Is Your Business Leaking Data Without You Knowing?
- Business Email Compromise: Why MFA Alone Is No Longer Enough
