11/04/2026
If you think you have been breached, here is what to do in the first hour.
Do not switch everything off. It is the first instinct and it is the wrong one. Shutting down destroys evidence you might need, and it does not undo anything.
Unplug from the network instead. Stop it spreading. Leave the machines running.
Write down the time. Who spotted it, when, what they saw. Your insurer will ask for a timeline, and writing it now is far more accurate than remembering it later.
Ring your IT provider and your insurer, within the hour. A lot of policies have notification deadlines measured in hours.
Do not discuss it over email if email might be compromised. Use the phone. Otherwise you are writing your response plan where the attacker can read it.
Say nothing to clients or publicly yet. You do not know enough. Correcting yourself later is worse than waiting.
The real lesson: nobody makes good decisions about this at 2am for the first time. Write the plan on a calm Tuesday.
Happy to help you write it. 877-707-TECC.