How to Respond to a Cyber Attack

No business wants to think about it, but having a plan before a cyber attack is what separates a bad day from a business-stopping crisis. Here is what to do in the first hours, and what to put in place now so you are ready.

Step 1: Contain the Damage

• Disconnect affected computers from the network. Unplug the cable or turn off Wi-Fi. Do not power them off, because that can erase evidence.
• Do not enter passwords on a computer you think is compromised.
• Stop the spread. Your IT team may temporarily block accounts, remote access or parts of the network.

Step 2: Call the Right People

1. Your IT and security team. Call, do not just email, since email may be compromised.
2. Your cyber insurance carrier. Many policies require prompt notice and have approved incident response firms. Calling early protects your coverage.
3. Your attorney, especially if client or employee data may be involved.
4. Your bank, immediately, if payments or banking credentials are affected.

Step 3: Preserve Evidence

Keep logs, suspicious emails and affected devices as they are. Write down what happened and when: who noticed it, what they saw and what was done. Investigators and insurers rely on this timeline.

Step 4: Investigate and Recover

Once the threat is contained, the team finds how the attacker got in, removes their access, resets passwords and restores systems from clean, tested backups. Recovery should be done in a careful order so the problem does not return.

Step 5: Notify and Communicate

Depending on what data was exposed, you may need to notify customers, employees or regulators. Work with your attorney and insurer on what to say and when. Clear, honest communication protects trust.

Step 6: Learn and Strengthen

After recovery, review what happened and close the gaps: MFA everywhere, better monitoring, staff training or tighter access. Every incident should leave you stronger.

Prepare Before It Happens

The best time to plan is now. Make sure you have:

• a written incident response plan with phone numbers that work if email is down
• tested, off-site backups
• 24/7 monitoring that can isolate threats quickly
• cyber insurance and a clear understanding of its requirements

Simplitfy helps businesses after a breach, including those that are not yet our clients. See how we protect computers in Lake Worth Beach, read about cyber liability insurance, or call 561-425-6100 right away if you are dealing with an incident now.