{"id":704,"date":"2026-08-03T12:44:38","date_gmt":"2026-08-03T17:44:38","guid":{"rendered":"https:\/\/cmitsolutions.com\/dayton-south-oh-1226\/?p=704"},"modified":"2026-08-03T12:44:38","modified_gmt":"2026-08-03T17:44:38","slug":"the-first-24-hours-what-to-do-when-you-suspect-a-cyber-incident","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/dayton-south-oh-1226\/blog\/the-first-24-hours-what-to-do-when-you-suspect-a-cyber-incident\/","title":{"rendered":"The First 24 Hours: What to Do When You Suspect a Cyber Incident"},"content":{"rendered":"

It usually doesn’t announce itself with a ransom note on every screen. More often, it starts small: a vendor calls asking why you changed your bank details. An employee mentions their sent folder is full of emails they never wrote. A file server slows to a crawl on a Tuesday afternoon for no reason anyone can name.<\/span><\/p>\n

What your business does in the next 24 hours will largely determine whether this becomes a bad day or a defining event. The companies that recover quickly aren’t lucky \u2014 they knew what to do before they needed to. The ones that suffer most tend to make the same handful of avoidable mistakes in the first few hours.<\/span><\/p>\n

Here’s a practical walk-through of that first day, and the missteps to avoid.<\/span><\/p>\n

Hour Zero: Contain, Don’t Clean<\/b><\/h2>\n

Your instinct will be to fix it \u2014 delete the weird files, run an antivirus scan, reboot everything. Resist that instinct.<\/span><\/p>\n

Disconnect, don’t power off.<\/b> If a machine looks compromised, unplug it from the network (pull the Ethernet cable, kill the Wi-Fi) but leave it running. Powering down can destroy the evidence in memory that investigators need to determine what happened and what was taken \u2014 evidence your insurer and, in some cases, regulators will ask about.<\/span><\/p>\n

Don’t wipe and reinstall yet.<\/b> Rebuilding a machine before anyone examines it is like mopping a crime scene. You may feel productive while eliminating the only record of how the attacker got in, which means you can’t be sure you’ve actually shut the door.<\/span><\/p>\n

Assume the attacker can read your email.<\/b> If your suspicion involves compromised accounts, coordinate the response by phone or text, not through the email system you suspect is breached. Attackers routinely monitor inboxes and delete or intercept warnings.<\/span><\/p>\n

Hours 1\u20134: Sound the Right Alarms<\/b><\/h2>\n

Call your IT provider immediately.<\/b> Not after the weekend, not after you’ve “looked into it.” Speed matters enormously here: attackers who realize they’ve been spotted either accelerate to do maximum damage or dig in deeper to survive cleanup. If you have a managed IT partner, this is exactly the call they exist for.<\/span><\/p>\n

Call your cyber insurance carrier’s hotline.<\/b> Most policies have a 24\/7 breach line \u2014 and most also have strict notification requirements. Waiting days to report, or hiring outside help the carrier hasn’t approved, can jeopardize your coverage. Your carrier can also bring in a breach coach (an attorney) and forensics team, often at the policy’s expense.<\/span><\/p>\n

Start a written timeline.<\/b> Who noticed what, when, and what actions were taken. Do it on paper or on a device you know is clean. This log becomes invaluable for insurers, investigators, and any required notifications later.<\/span><\/p>\n

Preserve your backups \u2014 offline.<\/b> If backups are connected to the network, an active attacker may target them next. Verify they exist, verify they’re recent, then isolate them.<\/span><\/p>\n

Hours 4\u201312: Figure Out the Blast Radius<\/b><\/h2>\n

With professional help engaged, the focus shifts to scope. Which accounts, machines, and data were touched? Was anything taken, or just accessed? Are the attackers still inside?<\/span><\/p>\n

This is where preparation pays off or its absence bites. Businesses with centralized logging and monitoring can often answer these questions in hours. <\/span>Businesses without them may never answer definitively \u2014 and when you can’t prove what <\/span>wasn’t<\/span><\/i> accessed, notification laws often force you to assume the worst.<\/span><\/p>\n

Two decisions typically surface in this window:<\/span><\/p>\n