A practical response plan for the first signs of trouble
Employees cannot open shared files. Customers are receiving messages you did not send. Or someone discovers a payment went to an account your vendor does not recognize.
If you are wondering what to do if your business gets hacked, start by getting the right people involved. You do not need a complete explanation before asking for help.
Contact your IT or security response provider and your cyber insurer’s incident-response contact promptly. If money may have been stolen, call the bank immediately too. These steps can happen at the same time.
What to do if your business gets hacked
1. Activate your response contacts
Give IT a factual account of what you noticed and when. Use a trusted phone number or another safe communication method if email may be compromised.
Follow the reporting instructions in your cyber insurance policy. TROXELL can help you locate the right claims contact and understand the reporting process, but contacting an advisor should not delay required notice to the insurer.
Ask about approved response specialists and authorization requirements before committing to major outside expenses, without delaying necessary emergency containment. Cyber policies may provide access to legal and technical response resources. The FTC identifies incident-response support as an important coverage consideration.
2. Contain the problem without destroying evidence
Let qualified responders guide the technical work. They may isolate affected computers or accounts, restrict access, and protect unaffected systems.
Do not start wiping devices, reinstalling software, or deleting suspicious messages. Preserve logs and other evidence. For suspected ransomware, CISA recommends isolating affected systems; powering them down can destroy volatile evidence and is generally a fallback when disconnecting them is not possible. CISA’s ransomware response guide explains the sequence.
For an owner managing a busy Springfield office, the useful instruction is simple: give employees a safe way to report problems and avoid having everyone attempt their own fix.
3. If money moved, contact the bank now
A fraudulent payment needs immediate attention. Ask your bank about recalling or freezing the transfer and contacting the receiving institution. Report suspected business email compromise to IC3.
Keep payment confirmations, account details, and the messages connected to the request. Do not wait for the technical investigation to finish before alerting the bank. See the FBI’s guidance.
4. Document what you know
Keep a secure incident record outside any suspected compromised system. Include discovery times, affected services, response contacts, business downtime, and recovery expenses.
Separate confirmed facts from assumptions. “We cannot access these files” is different from “all customer information was stolen.” Investigators need room to establish what happened.
5. Coordinate legal notices and communications
Not every cyber incident involves a reportable data breach. Notification duties depend on the information involved, affected people, applicable laws, and contracts.
Have qualified counsel and the response team determine whom to notify and when. Avoid guessing about deadlines or reassuring customers that no data was affected before that is established. Prepare accurate updates through trusted channels. The FTC’s business breach-response guide covers these responsibilities.
6. Restore operations carefully
Work with IT to confirm systems are safe before reconnecting devices or restoring backups. Getting back online quickly matters, but restoring an unresolved compromise can prolong the disruption.
If there is a ransom demand, involve the insurer, qualified counsel, response specialists, and law enforcement. The FBI does not support paying ransoms, and payment does not guarantee recovery. Legal restrictions and insurance conditions can also apply. Read the FBI’s ransomware guidance.
Prepare the contact list before you need it
Keep an accessible copy of your IT emergency number, insurer’s response hotline, policy details, bank fraud contact, and internal decision-makers. Store a copy where a network outage will not lock you out.
Confirm who can authorize urgent decisions and what staff should do if the usual manager is unavailable. A one-page response plan is useful only if employees can find it.
Where TROXELL fits
IT specialists handle technical investigation and recovery. Legal advisors guide legal obligations. Your insurer determines coverage under the policy.
TROXELL can help you report the incident, understand coverage questions, and navigate the claims process. Before an incident, ask us to review your response contacts and policy requirements so those details are easier to find when you need them.