Hit by a cyberattack: what to do in the first hour
Locked computers, hacked email, suspicious transfers: the first decisions shape what follows. This guide sets out the order of actions to take; print it and keep it close at hand.
Kayzen Security editorial team3 min read
1. Contain
- Unplug devices that appear to be affected from the network (cable and Wi-Fi).
- If the attack is spreading, cut the site's internet access or isolate the affected network.
- From a clean device, change the passwords of compromised accounts, starting with email and administrator accounts.
- Disconnect any backups still connected to the network.
2. Alert
- Your IT provider or your security contact.
- Senior management, who decide on communication and reporting.
- Your bank, immediately, in the event of a fraudulent transfer or any doubt about the accounts.
- Your insurer if you have cyber cover: some policies set a deadline for reporting and provide assistance. Be aware that compensation requires a complaint filed within 72 hours (see below).
3. Preserve the evidence
- Note the time of each finding and each action in a log.
- Photograph the messages displayed on screen.
- Keep suspicious emails with their headers, logs and devices as they are.
- Do not delete or reinstall anything without the advice of the professional helping you.
4. Get help and report
- 17Cyber (17cyber.gouv.fr): free online diagnosis and advice; Cybermalveillance.gouv.fr refers you to providers holding the ExpertCyber label.
- File a complaint with the police or gendarmerie without delay. Businesses insured against cyber risk: the French insurance code (article L.12-10-1) makes compensation conditional on filing a complaint no later than 72 hours after the attack is discovered. File a complaint without delay, then notify your insurer. To be confirmed with your insurer or a professional.
- Personal data breach: notify the CNIL without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to individuals; inform the people concerned in the event of a high risk (GDPR articles 33 and 34).
- Entities subject to NIS2: in the event of a significant incident, early warning to the CSIRT or the competent authority within 24 hours, notification within 72 hours, final report within one month. To be validated by a professional.
- Do not pay a ransom: this is the consistent recommendation of the authorities.
5. Restart and learn the lessons
- Understand the entry point and fix it before putting everything back into service.
- Restore from clean, verified backups.
- Closely monitor accounts and computers in the weeks that follow.
- Hold a lessons-learned review and update your response plan.
Reporting obligations (GDPR, NIS2, insurance policy, complaint within 72 hours for cyber compensation) depend on your situation: have them validated by a professional. This guide is for information only and does not replace support from a qualified provider.
Official sources
- 17Cyber (new tab) — Le réflexe en cas de cybermalveillance (Police nationale, Gendarmerie nationale, Cybermalveillance.gouv.fr)
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
- CNIL (new tab) — Commission nationale de l'informatique et des libertés
- EUR-Lex (new tab) — Règlement (UE) 2016/679 (RGPD)
- EUR-Lex (new tab) — Directive (UE) 2022/2555 (NIS 2), Journal officiel de l'Union européenne
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.