The worst hour of an office security incident is usually made worse by panic: machines wiped before anyone looked, passwords changed from the infected PC itself, the suspicious email deleted. This plan replaces panic with a short, calm sequence anyone can start.
You do not need an incident-response department. You need the first hour to be boring. Boring means: stop the spread, protect the accounts from a clean machine, preserve a little evidence, and call for help early instead of heroically late. This page is written for the three incidents a small office actually faces - ransomware or encrypted files, a compromised mailbox, and a suspicious payment - and for the discovery moment itself, whether that is a ransom note, a customer asking why you emailed them an invoice, or the bank calling. Print this page and keep it with the router passwords; the incident is the wrong time to search for it.
If files are being encrypted or a machine is behaving wildly, disconnect it from the network immediately - pull the cable, turn off its Wi-Fi. Do not shut it down unless it is actively destroying things in front of you; memory and running state are evidence, and some recovery options die with a power cut. Never connect a clean backup drive to a network you suspect is infected.
Then stop and note, in plain words on paper: what you saw, when you first saw it, and which machines and accounts are involved. Times remembered later are always wrong; times written down in the first hour hold up.
Go to a device you trust - a phone on mobile data is fine - and change the important passwords from there, never from the suspect PC: email first, then banking, then the admin and remote-access accounts. Revoke active sessions where the service allows it and confirm MFA is on.
If the mailbox is the incident - sending spam, rules appearing, mail vanishing - also check for forwarding rules and delegates you did not create. Attackers plant them to keep access after the password change, and removing them is part of actually closing the door.
Three calls, in this order. Your IT support person or company, if you have one - before you attempt your own cleanup. Your bank, immediately, if any payment looks wrong or any banking detail changed; banks can sometimes recall transfers inside a short window that panic wastes. And your cyber insurer if you have a policy - many require notification before you spend on recovery.
Be honest with yourself about the ransom question while calm heads are available: paying is unreliable, may be unlawful in some situations, and marks you as a payer. The decision belongs with professional advice and your insurer, never with the countdown timer on the ransom note.
Tell staff what happened in one honest paragraph: what is affected, what you need them to do or not do, and when the next update comes. Silence breeds rumours and secret workarounds on personal laptops - which create a second incident. If customer data may be involved, take advice on your notification duties; in many places the law sets deadlines, and honest early communication is always better received than a late surprise.
Preserve the basics: the ransom note file, the phishing email with headers if you can, the sign-in logs, and your paper timeline. Do not wipe and rebuild the first machine until your support or insurer says the evidence is captured - rebuilding feels decisive and often destroys the only clues about how they got in.
Every essential in this guide is explained with full knowledge and installation in the IT Security Essentials video.
Watch Full VideoIsolate affected machines from the network, yes. A building-wide power-off destroys evidence, can corrupt data mid-write, and still does not remove the attacker from cloud accounts. Disconnect, do not erase, and protect accounts from a clean device.
Start with your bank if money is involved, your insurer if you have cyber cover, and then a reputable local IT firm - incident work is a normal service. Your internet provider and software vendors can also help secure accounts. The mistake is not lacking a contract; it is spending the first day trying to fix it secretly in-house.
If their data or payments may be affected, almost certainly yes, and often within a legally set time frame. Take advice quickly, be specific about what happened and what you have done, and warn them about follow-up phishing that may misuse the stolen thread history.