What to do if you think you've been hacked

First hour: contain, don't panic

If something looks wrong — ransomware message, colleagues getting weird emails "from you", unexpected bank payments — the instinct is to click around until it goes away. Don't.

Do this first:

• Disconnect affected PCs from Wi-Fi or ethernet (pull the cable or toggle airplane mode)
• Don't power off servers unless we tell you to — sometimes we need memory state
• Tell everyone to stop using shared drives until you know scope
• Call your IT provider (or us) and your bank if money moved

Second hour: protect identities

Assume passwords on the affected account and anything linked to it are burned.

• Reset email password from a clean device
• Sign out all sessions in Microsoft 365 / Google admin
• Enable MFA if it wasn't on
• Check mailbox rules — attackers love auto-forward rules to hide in plain sight

What we look for when we arrive

We check whether it's isolated (one laptop) or estate-wide (domain admin compromised). We review backup integrity before touching anything — restoring from a poisoned backup makes everything worse.

We also look at:

• Recent sign-in logs and impossible travel
• New admin accounts or group membership changes
• Scheduled tasks and startup items on PCs
• Email transport rules and OAuth app consents

After the dust settles

Incidents are expensive, but they're also the moment most businesses finally fix the basics: MFA, tested backups, least-privilege admin, and staff awareness.

We'd rather help you before that moment. If you're reading this mid-crisis, contact us urgently — put "URGENT" in the subject and include a callback number.