When something goes wrong: the first hour

What you will be able to do

• Follow a short order of actions under stress.
• Avoid the common mistakes that destroy evidence or spread the damage.
• Know what to prepare before an incident.

Why a plan helps

In a real incident people act quickly, alone and with partial information. NIST SP 800-61 Rev. 3 (2025) ties incident response to the six functions of the Cybersecurity Framework 2.0: govern, identify, protect, detect, respond and recover. The older Rev. 2 described the same work as preparation, detection and analysis, containment, eradication and recovery, and lessons learned, a sequence that is still a useful way to think about it. Most of the value comes from deciding in advance who does what.

The first hour

These steps fit a suspected compromise of a computer or an account. The order matters.

• Write down what you saw and the time, before anything changes.
• Disconnect the affected device from the network (cable out, Wi-Fi off). Do not switch it off unless advised, because memory can hold evidence.
• From a different, clean device, change the passwords of affected accounts, sign out all sessions and check the recovery settings.
• Tell the person responsible: your IT contact, the service provider or the bank. If money moved, call the bank on the number printed on the card at once.
• Keep the evidence: messages, screenshots, the ransom note, headers of the e-mail. Do not delete or tidy.

Ransomware: specific points

Isolate the device and any shared storage it can reach. Do not rush to pay: payment guarantees neither a working key nor that the data was not copied, and it funds the next attack. Check which backups are intact and offline before doing anything else, and take advice from your IT provider or the national response centre.

Telling people

Early, factual notice is better than a complete one that arrives late. If personal data may have been exposed, legal duties to notify may apply to an organisation; the person responsible for data protection should be involved from the start. Do not discuss the details in public channels.

Afterwards

Once it is over, ask what allowed it, what slowed the response and what one change would have helped most. Write that down and do it. This is how the same incident does not happen twice.

Key points

1. Note, isolate, change credentials from a clean device, tell, keep evidence.
2. Do not tidy; do not pay in a hurry.
3. Decide roles before an incident.

Go further

• Checklist →
• Threat profile: Ransomware →
• Threat profile: Account takeover →
• Threat profile: Malware →
• Scenario: The locked shared drive →

Sources

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations and Considerations for Cybersecurity Risk Management ↗
• CISA — #StopRansomware Guide ↗
• USOM — National Cyber Incident Response Center ↗