Nobody plans to read this article on the day they need it. But breaches announce themselves at inconvenient times: a ransom note on a Monday morning screen, a customer calling about a strange invoice, a bank flagging a wire that already left. What you do in the first 24 hours shapes the final cost, the legal exposure, and how much sleep you lose over the next six months.
Here is the good news: the right moves are not complicated. They are mostly about order. Do things in the wrong sequence, wipe first and ask questions later, and you can turn a bad day into a very expensive year. IBM’s 2025 Cost of a Data Breach Report put the global average cost of a breach at 4.44 million dollars, and the through line in that research is that time and early decisions drive the bill. So let’s walk the clock.
Hour One: Contain It Without Destroying It
Your instinct will be to shut everything down and delete anything that looks infected. Fight that instinct. Disconnect affected computers from the network: unplug the ethernet cable, turn off the wifi. But leave the machines powered on. The Federal Trade Commission’s breach response guidance is explicit on this point: take affected equipment offline immediately, but do not turn machines off until forensic experts arrive. Evidence of what happened, including some that lives only in a computer’s temporary memory, disappears when the power does.
- Do: disconnect affected machines from the network, note the exact time, photograph anything unusual on screen, and start a written log of every action you take.
- Do not: wipe or reinstall anything, delete suspicious emails, run cleanup tools, or poke around inside affected accounts out of curiosity. The FTC’s guidance says it directly: do not destroy forensic evidence during your investigation and cleanup.
- Also do not: discuss the incident over the email system you suspect is compromised. If attackers are reading your inbox, they are reading your response plan too. Switch to phone calls and texts for now.
Hours 2 to 6: The Call List, In Order
This is where sequence matters most, and where well-meaning businesses go wrong. Here is the order that protects you:
- Your IT provider or MSP. They can see what you cannot: which accounts were touched, which machines are affected, what data may have left. If you have no provider, this is the moment to engage an incident response firm, not to improvise.
- Your cyber insurance carrier, before any cleanup. This one surprises people. Policies commonly require prompt notice, and many require you to use the insurer’s approved forensic and legal vendors. Rebuild everything first and you can put your own coverage at risk. The hotline number is on your policy. Call it before anyone starts fixing.
- A lawyer with breach experience. Often provided through the insurer. Notification requirements vary by state and by the type of data involved, and getting them wrong creates a second problem bigger than the first.
- Your bank, if money moved. If a fraudulent wire or payment went out, minutes matter. Ask the bank to attempt a recall and freeze anything still pending.
- Law enforcement. Report to the FBI at IC3.gov. The FBI’s Internet Crime Complaint Center recorded 20.9 billion dollars in cybercrime losses in 2025 alone, so they have seen your exact situation, and the report creates a record that insurers, banks, and courts take seriously.
Hours 6 to 12: Scope It and Face the Communication Question
With responders working, the central question becomes: what did the attacker actually reach? Email only? File servers? Customer records? Payroll? The honest answer early on is usually “we do not know yet,” and that is fine. What you should resist is announcing conclusions before you have facts, in either direction. “It was nothing” and “everything is gone” are both guesses.
Communication in the first day is a series of small, deliberate decisions. Employees need clear instructions about what not to touch, without speculation about blame. Customers and partners whose money or data may be involved should eventually hear it from you, not from a rumor or a scammer exploiting the confusion. Your lawyer will shape the legally required notices. Your job is to make sure the tone sounds like you: straightforward, specific, no spin. Companies far larger than yours wrestle with the same choices, something we explored in what the Stryker cyberattack tells us about the threats facing every business.
Hours 12 to 24: Recover Deliberately
Once forensics gives a green light, recovery begins in order of trust. Restore from backups made before the intrusion, onto systems verified clean. Reset passwords broadly, starting with administrator accounts, and turn on multi-factor authentication anywhere it is missing. Assume the attacker tried to keep a spare key: responders will hunt for new user accounts, mailbox forwarding rules, and remote access tools that do not belong.
Expect this phase to run past hour 24, and do not treat that as failure. IBM found that identifying and containing a breach took organizations an average of 241 days, the lowest figure in nine years and still a sobering number. The businesses that land on the short end of that curve are the ones that contained carefully and called the right people on day one.
The Mistakes That Make It Worse
- Wiping machines immediately. It feels productive, and it destroys the investigation, the ability to know what was taken, and possibly your insurance claim.
- Paying a ransom in a panic. That is a decision to make with your insurer, your lawyer, and your responders. Never alone, and never in the first hours.
- Blaming the person who clicked. Punish the click and you guarantee the next incident gets reported later, when it is worse. The employee who speaks up fast is your best early warning system.
- Going quiet. Silence reads as cover-up to customers, partners, and regulators alike, and it hands the story to someone else.
- Declaring victory early. Attackers often leave a way back in. Let responders confirm the house is actually empty before you relax.
The Bottom Line
The first 24 hours reward preparation more than brilliance. Contain without destroying. Call your IT provider, then your insurer, then legal, then the bank, then the FBI, in that order. Communicate facts, not guesses. And write the call list down now, on paper, with your insurer’s hotline and your IT provider’s number, stored somewhere that is not on the network you might lose. A one-page plan you can find at 6 a.m. beats a thick binder nobody opens.
Harrison Ward Technology builds, tests, and answers for incident response plans for small and mid-sized businesses across Denton County. If you do not know who you would call first, let’s fix that this week, calmly, before it matters. Contact us today
Sources:
Comments are closed