We think we were hacked, and we don’t yet know what happened.

Start with one person who decides

Name one person who can say “take that computer off the network” and “disable that account,” and who can be reached by phone. Name a second to keep the log. The decision-maker doesn’t have to be technical. The questions are business questions: what stops, who is told, who is called.

The FTC’s guide says to name one person to release information and to assemble experts as the situation calls for: IT, forensics, legal, operations, management. It says to talk to your own counsel first. CISA recommends phone calls rather than email for the early conversations, because a mailbox you suspect may be read by the person you’re trying to shut out.

Tell staff what to do and what not to do. The UK NCSC’s advice is never to punish people for clicking a link or opening an attachment. The employee who hides a click costs you the hours you’re trying to save.

The log, in the order things happened

Write what you know and say “not known” where it isn’t. CISA’s response checklist asks the team to develop and document an initial understanding of what has occurred, which is a different thing from naming a cause on day one.

1. Write the date and time you started the log.
2. Record who noticed what, and when. The FTC says to interview the people who found the problem.
3. Photograph what was on screen, including any date and time.
4. Record each action taken since, who took it, and when, including restarts, password changes, and deleted messages.
5. List the accounts and computers that might be involved, and what each is used for.
6. Record the business effect: payments, orders, customers who were contacted.

What to keep

• Messages in the mailbox, including the ones sent in your name.
• Computers that behaved oddly: off the network, powered on. The FTC says to take affected equipment offline right away but not to power it down until forensic experts arrive.
• Anything the computer or account shows today, saved as a screenshot, before anything is changed.
• The FTC is plain: do not destroy evidence.

Changes, and the order that makes them stick

Make these from a computer you trust that isn’t the one in question. The FTC’s guide notes that a system stays vulnerable until stolen credentials are changed. Microsoft’s steps for a compromised Microsoft 365 account give an order, and the order matters because each step closes a different way back in.

1. Disable the account in doubt. If you can’t, reset its password, and don’t send the new one by email.
2. Revoke active sign-in sessions. Microsoft treats this as its own step, because a password change alone doesn’t end a session that is already open, and app passwords aren’t revoked when the password changes.
3. Review the multifactor sign-in methods and registered devices, and remove any you don’t recognize.
4. Review the apps that have been given permission to the account, and the administrator roles it holds.
5. Review forwarding and hidden inbox rules.
6. If money moved, call the bank or payment company the same day.

Who hears about it, and when

On day one: your IT person or provider, your insurer (the policy may set a notice period), your bank if money is involved, and an attorney before any customer notice. Report to law enforcement through CISA, the FBI, or your local police, as the who-to-tell page lays out. Hold any company-wide or customer message until the facts and counsel are in. A notice that guesses at a cause is hard to take back.

Whether to change every employee’s password on day one is a judgment call. It is cheaper once you know which accounts were in play, and it should be decided by the person you named, with your IT person.

What the first day can’t settle

Nothing here says whether you were hacked. It keeps the record intact, closes the doors you can see, and sets the order in which people hear about it. A clean result from any later check covers what was examined, on the date it was examined.

The first day doesn’t have to find out what happened; it has to leave you able to.

Related

• Who to Tell After a Security Incident, and in What Order
• Keeping Evidence Before You Clean Up a Computer
• What to Write Down Before You Call for Help
• Business Email Hacked: Take the Account Back in Order

Sources

• FTC: Data Breach Response, A Guide for Business
• CISA: #StopRansomware Guide
• Microsoft Learn: Respond to a compromised email account in Microsoft 365
• UK National Cyber Security Centre: APT28 exploit routers to enable DNS hijacking operations