What to Do in the First Hour of a Cyberattack

When a cyber incident hits, the first hour is not the time to improvise.

A staff member may see a ransom note, lose access to email, notice strange bank-detail changes or receive an alert about a login they did not make. The natural reaction is to click around, delete suspicious messages, restart devices and email everyone.

Those actions can spread the problem, destroy useful evidence or warn an attacker who is already reading the inbox.

The first goal is containment. The second is getting the right people involved. Recovery comes after you understand what happened.

Start a separate line of communication

Assume the affected email or messaging account may be visible to the attacker. Call your IT provider by phone using a number you already trust. Do not use contact details from a pop-up, ransom note or unexpected support message.

If the usual communication system is affected, move the response to a known-clean channel. That could be a phone call and a separate chat involving only the people managing the incident.

Write down when the problem was first noticed, who found it, which device or account was involved and what appeared on screen. A simple incident log helps when several people are making decisions quickly.

Contain the affected device

If it is safe and practical, disconnect an affected computer from the network. Unplug its network cable and turn off Wi-Fi. Do not reconnect it to copy files or check whether the problem has gone away.

Whether a device should remain powered on depends on the incident. Turning it off may stop active damage, but it can also remove evidence held in memory. Australian guidance also recognises that incident response needs to fit the circumstances.

The useful rule for a small business is: isolate the device, stop using it and follow the direction of the incident-response person. Do not start wiping, reinstalling or running random cleanup tools.

If several devices show the same symptoms, tell your IT provider immediately. That may change the containment plan for the network, servers, backups and cloud accounts.

Protect accounts from a clean device

An incident is often an identity problem before it becomes a device problem. A stolen Microsoft 365 password can let an attacker read email, reset other accounts and impersonate the business.

From a device you have good reason to believe is clean, reset the affected password and revoke existing sign-in sessions. Check multi-factor authentication, meaning the extra sign-in check beyond a password, and remove any method you do not recognise.

Start with the most important accounts:

• Microsoft 365 or Google Workspace administrators
• business email
• banking and payment platforms
• accounting software
• remote-access tools
• password managers
• backup administration

Changing every password blindly can make the response harder. Prioritise confirmed or likely exposure, then work through the remaining accounts with the person leading the incident.

Call the bank if money or payment details are involved

If money has been transferred, invoice details have been changed or banking information may be exposed, call the financial institution immediately.

Do not wait for the full technical investigation. The bank may be able to stop or recall a transaction, secure the account or tell you what evidence it needs. Australian Government guidance is clear that early contact gives the best chance of a useful outcome.

Warn affected customers or suppliers through a trusted channel if an attacker has impersonated your business. Do not rely on the compromised mailbox to correct the scam.

Preserve what happened

Do not delete the suspicious email, ransom note or security alert. Do not clear browser history or remove an unknown inbox rule before someone has recorded it.

Take photos or screenshots where practical, but keep the original evidence in place. Record:

• the date and time, including the time zone
• the people and devices involved
• messages shown on screen
• suspicious sender addresses, links and file names
• transactions or bank-detail changes
• actions already taken

The Australian Signals Directorate recommends planning for evidence collection and preservation. For a small business, that does not mean becoming a forensic investigator. It means avoiding unnecessary changes and keeping a reliable record for the specialists, insurer, bank or police.

Notify your insurer early

If you hold cyber insurance, use the policy’s incident number and follow its process. Some policies require the insurer or its nominated response team to be involved before external costs are incurred or major recovery decisions are made.

Keep the policy and contact details somewhere available when normal systems are offline. A copy stored only in the compromised Microsoft 365 account is not much help.

Do not decide whether to pay a ransom in the first panicked hour. The Australian Government strongly discourages ransom payments because payment does not guarantee recovery or prevent stolen data being released. It can also create legal and sanctions issues.

That decision needs input from the incident-response team, insurer, legal adviser and relevant authorities.

Report the incident

Australian businesses can report cybercrime through ReportCyber. If the incident involves an immediate threat to life or physical safety, use the normal emergency-services process.

Reporting can help connect the incident with other cases and creates a reference that may be useful to a bank or insurer.

If personal information may have been accessed or disclosed, the Notifiable Data Breaches scheme may apply. It is not a blanket 72-hour rule in Australia. An organisation covered by the scheme generally has up to 30 calendar days to assess a suspected eligible breach, but the Office of the Australian Information Commissioner expects assessment to happen much faster where possible. Eligible breaches must be notified as soon as practicable.

Get legal or privacy advice early rather than guessing whether the threshold has been met.

Prepare one page before you need it

Most Northern Beaches businesses do not need an enterprise incident-response manual. They do need a usable first page.

It should contain:

• who has authority to declare an incident
• your IT provider’s trusted phone number
• insurer and policy details
• bank fraud contacts
• an alternative communication method
• the location of tested backups
• the accounts and systems that matter most
• the ReportCyber address

Print a copy and store another copy somewhere separate from the main Microsoft 365 environment.

Then test it. A short tabletop exercise, where the team talks through a believable incident, often exposes missing phone numbers, unclear authority and backups nobody has tested.

Preparation also means putting the everyday controls in place. Cybersecurity support should cover protected identities, managed devices, reliable backups, monitoring and a response path people can follow.

The order matters

In the first hour, use a trusted phone number, contain affected systems, protect critical accounts from a clean device, call the bank when money is involved, preserve evidence, notify the insurer and report the incident.

Do not make the recovery plan up while the attacker is still active.

Vaelis IT helps businesses across the Northern Beaches prepare a practical incident plan and put the controls behind it. If your current plan is a phone number stored in one person’s inbox, we can help turn it into something the business can use under pressure.