iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A cyberattack is an attempt to compromise a business’s systems, accounts, or data. If you suspect one, activate your incident-response plan, alert the person responsible for IT or security, isolate affected equipment without shutting it down, secure compromised accounts, preserve evidence, and bring in qualified investigators. Then determine what was accessed, report to the appropriate authorities, and obtain legal advice before deciding whether customers or regulators must be notified.
What counts as a cyberattack?
Cyberattacks are deliberate attempts to gain unauthorized access, disrupt operations, steal information, extort money, or impersonate someone the business trusts. The Federal Trade Commission (FTC) identifies phishing, ransomware, business-email impersonation, and tech-support scams as common small-business threats in its Cybersecurity for Small Business guidance.
| Attack type | What the attacker tries to do | Typical warning signs |
|---|---|---|
| Phishing | Steal passwords or deliver malware through a message, link, attachment, or fake sign-in page | An urgent request that appears to come from a manager, vendor, bank, or service provider |
| Ransomware | Encrypt or otherwise block access to files and systems, then demand payment | Files will not open, filenames change, systems display a ransom note, or shared drives become unavailable |
| Business-email impersonation | Use a compromised or lookalike account to obtain credentials or persuade staff to transfer money | A request to change payment instructions, buy gift cards, send payroll data, or keep a transaction secret |
| Tech-support scam | Trick someone into granting remote access or installing malicious software | An unexpected call, pop-up, or message claiming that a device is infected and demanding immediate access or payment |
One event can involve several techniques. For example, a phishing message can steal an employee’s password, the attacker can use that account to impersonate the employee, and a later ransomware attack can reach shared files. Treat the first suspicious sign as a possible incident rather than waiting for proof of the attacker’s full objective.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do in the first hours
Move quickly, but avoid actions that destroy information investigators need. The sequence below is designed for a small business that may not have a full-time security team.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
-
Activate your plan and name an incident lead
Use the written incident-response plan if you have one. Tell the owner or executive decision-maker, the internal IT or security contact, and any managed service provider. Assign one person to coordinate decisions, maintain the timeline, and approve communications. Record the date and time the alert was received, who reported it, and what was observed.
If there is no plan, create a temporary incident team immediately: one decision-maker, one technical coordinator, one person handling legal and insurance contacts, and one communications owner. Limit casual discussion of the incident to the people who need to act.
-
Isolate suspected devices without powering them off
If malware or unauthorized access is suspected on a computer or server, disconnect it from wired and wireless networks. Remove the network cable, disable Wi-Fi or Bluetooth, or place the device on a quarantine network if your IT staff can do that safely. Do not turn the device off, restart it, wipe it, or reinstall the operating system while evidence may be needed. The FTC warns that shutting down can remove useful investigation information.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Do not disconnect equipment blindly if doing so could endanger safety systems or destroy a critical service. Have an experienced administrator document the decision and isolate the smallest practical set of systems. If an entire network is affected, ask qualified responders to direct the shutdown or segmentation process.
-
Secure accounts and stop unauthorized transactions
Change passwords for accounts known or suspected to be compromised, starting with administrator, email, remote-access, cloud-storage, payroll, banking, and password-manager accounts. Use a clean device for the changes when possible. Revoke active sessions and reset multifactor-authentication methods if an attacker may have registered a new device or stolen recovery codes.
Tell the bank and payment processor to watch for or stop suspicious transfers. Freeze changes to supplier bank details until they are verified through a known telephone number. Do not reply to a suspicious message to confirm instructions; use a separately verified contact channel.
Rank #2
Sale
WD 5TB My Passport, Portable External Hard Drive, Black, backup software with defense against ransomware, and password protection, USB 3.1/USB 3.0 compatible - WDBPKJ0050BBK-WESN- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
-
Bring in experienced help
Engage an incident-response or digital-forensics professional if your staff cannot establish what happened, preserve evidence, or contain the intrusion safely. Choose help based on capabilities rather than a logo or a generic “cleanup” promise. Ask whether the team can perform forensic collection, identify the initial access, scope affected systems and data, support containment and recovery, and work in your industry and jurisdiction.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Confirm availability, response time, geographic coverage, conflicts of interest, confidentiality terms, and exactly what is included. Ask who will make technical changes and who will document them. Your lawyer or insurer may have a panel of providers, but the business should still verify that the proposed team can preserve evidence and communicate findings clearly.
-
Preserve evidence and maintain a timeline
Keep suspicious emails, message headers, ransom notes, log files, alerts, screenshots, call recordings, and relevant access records. Preserve them in their original form and store copies where the attacker cannot alter them. Do not delete accounts, wipe devices, or “clean up” logs merely to make systems usable.
Record every action: who isolated a device, which credentials were reset, what systems were taken offline, when backups were checked, and which outside parties were contacted. The FTC’s Data Breach Response: A Guide for Business emphasizes preserving evidence while responding. A reliable timeline helps investigators reconstruct access, supports insurance and legal decisions, and prevents contradictory instructions.
-
Determine the initial scope
Ask investigators to establish how access occurred, which accounts and devices were involved, what systems or data were reached, whether the attacker still has access, and whether persistence mechanisms remain. Review identity-provider sign-ins, email forwarding rules, privileged-account activity, endpoint alerts, firewall and remote-access logs, cloud audit trails, and unusual data transfers.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Separate confirmed facts from working hypotheses. For example, “the mailbox rule was created at 09:14 UTC” is different from “the attacker stole the customer list.” Preserve that distinction in internal notes and external communications.
Rank #3
Seagate One Touch 24TB External Hard Drive Desktop HDD - USB-C Compatible with Most Windows and macOS, Rescue Recovery (STNB24000400)- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
-
Report the incident and obtain legal advice
Report criminal conduct, extortion, fraud, or threats to the appropriate law-enforcement authority. Your industry regulator, payment network, contract, or cyber-insurance policy may require additional notice. Ask counsel how to preserve privilege and coordinate technical findings with legal review.
Notification duties depend on the jurisdiction, the type of information involved, and other applicable laws. In the United States, all states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have breach-notification laws involving personal information, but definitions, deadlines, recipients, and exceptions differ. Do not assume that one national deadline applies. Counsel should identify the rules for every affected person and location and coordinate timing with law enforcement when notice could interfere with an investigation.
-
Communicate accurately
Give employees practical instructions: do not log in from a suspected device, do not forward sensitive material, preserve messages, and route questions to the incident lead. Tell customers, suppliers, and other affected stakeholders what is confirmed, what actions they should take, and where they can obtain updates. Avoid unsupported claims about the attacker, the number of records, or the absence of risk. Update statements as facts are verified.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Use the right response for the situation
I clicked a suspicious link
Stop entering information, disconnect the device from the network without shutting it down, and report the message. From a clean device, change any password entered on the page and any other account that reused it. Ask IT to check for new mailbox rules, unauthorized sessions, browser extensions, downloaded files, and signs of lateral movement. Keep the original message and its headers for investigation.
Our files are locked or a ransom note appeared
Isolate affected devices and shared storage. Do not connect backup media to an infected network until responders have assessed it. Preserve the ransom note, payment instructions, timestamps, and a sample of affected filenames. Investigators should identify the entry point, determine whether data was copied, and remove the attacker’s access before restoration. Paying does not guarantee decryption, deletion of stolen copies, or that the vulnerability has been fixed.
We think an employee account was hacked
Disable or secure the account through your identity system, revoke sessions and tokens, and check for forwarding rules, delegated access, newly created applications, and password-reset changes. Review messages sent from the account and warn recipients through a trusted channel. Check whether the account had access to payroll, customer information, source code, cloud administration, or other sensitive systems.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
A payment or bank-detail change looks fraudulent
Contact the bank, payment processor, and intended recipient immediately using independently verified contact details. Ask whether a transfer can be recalled or held. Preserve invoices, email headers, call details, approval records, and account-change logs. Treat the event as both a financial-fraud incident and a possible account compromise.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How investigation leads to recovery
Containment is not the same as recovery. A complete response answers four questions:
- How did access occur? Identify the phishing page, stolen credential, unpatched service, exposed remote-access tool, malicious advertisement, infected website, or other entry point.
- What was affected? Inventory accounts, endpoints, servers, cloud services, backups, applications, and data repositories, including systems operated by vendors.
- How is access removed? Reset credentials, remove persistence, close the exploited vulnerability, patch software, rotate keys, tighten permissions, and verify that monitoring detects renewed activity.
- How will operations be restored? Rebuild or clean systems when appropriate, restore known-good data, test critical workflows, and keep heightened monitoring in place.
Backups that are kept off the network can help restore files after ransomware, but they do not replace containment or investigation. Maintain multiple restore points, test that files can actually be recovered, and protect backup credentials and hardware from the same compromise. An external drive sitting permanently connected to a workstation is not an offline backup.
Prevention changes to make after the incident
Use the incident’s findings to reduce the chance and impact of a repeat event. The FTC recommends regular software updates and backups, employee training, multifactor authentication, limited access, security software, and a written incident-response plan in its small-business cybersecurity guidance.
- Patch consistently: Track operating systems, applications, internet-facing services, and remote-access tools; prioritize vulnerabilities that attackers can exploit from the internet.
- Train for realistic decisions: Teach staff how to verify urgent payment requests, report phishing, use password managers, and contact help without fear of punishment for reporting a mistake.
- Use multifactor authentication: Require it for email, administrator, remote-access, financial, and cloud accounts; prefer phishing-resistant methods where practical.
- Limit privileges: Give each person only the access required for their role, separate administrator accounts from everyday accounts, and review vendor access.
- Protect and test backups: Keep regular copies, including copies not connected to the network, and perform documented restoration exercises.
- Write and rehearse a response plan: Include contact details, isolation instructions, evidence-handling rules, decision authority, legal and insurance contacts, communication templates, and recovery priorities.
The FTC describes the NIST Cybersecurity Framework 2.0 as a free, voluntary, flexible framework organized around Govern, Identify, Protect, Detect, Respond, and Recover. A small business can use those six functions to assign ownership and check that prevention, monitoring, response, and recovery are all covered rather than focusing only on antivirus software.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choosing technical help and cyber insurance
Questions for an incident-response or forensic team
| Selection area | Questions to ask |
|---|---|
| Capability | Can the team collect forensic images, analyze logs and cloud activity, contain the intrusion, and explain the root cause? |
| Experience | Has it handled your industry, technology stack, regulatory environment, and the attack type you suspect? |
| Availability | Is help available now, including nights or weekends, and who is the named incident lead? |
| Evidence handling | How will originals, hashes, chain of custody, and privileged work be handled? |
| Scope and cost | What is included in the initial retainer, what triggers additional work, and what deliverables will you receive? |
| Geography | Can the team support every location and jurisdiction affected by the incident? |
What to check in a cyber-insurance policy
Discuss policy fit with an insurance agent before an incident. Compare first-party coverage for your own investigation, restoration, notification, legal, and business-interruption costs with third-party liability coverage for claims by customers or other parties. Inspect limits, exclusions, waiting periods, extortion terms, breach-hotline access, forensic and legal support, ransom-payment conditions, vendor requirements, and whether a failure to follow specified security controls could affect coverage.
Mistakes that make an incident worse
- Shutting down or wiping a suspected device before evidence is collected.
- Continuing to use a compromised account to send instructions or approve payments.
- Negotiating with an attacker or paying a ransom without legal, technical, insurance, and law-enforcement advice.
- Announcing an unverified number of affected records or promising that no further risk exists.
- Restoring from backups before removing the access method that allowed the attack.
- Assuming that a lack of visible damage means no data was accessed.
- Waiting for certainty before contacting qualified responders, banks, insurers, regulators, or counsel.
“The only thing worse than a data breach is multiple data breaches.”
Quick Recap
SaleBestseller No. 2Bestseller No. 3
A printable first-response checklist
- Record what was observed, when, and by whom.
- Activate the incident plan and assign one coordinator.
- Alert IT, security, leadership, counsel, and the insurer as appropriate.
- Isolate suspected devices and accounts; do not power off devices that may contain evidence.
- Change known-compromised credentials from a clean device and revoke sessions.
- Contact banks and payment processors about suspicious transactions.
- Preserve messages, logs, ransom notes, screenshots, and devices; maintain a timeline.
- Engage qualified incident-response or forensic help to establish scope and containment.
- Evaluate reporting and notification duties for each affected jurisdiction and data type.
- Communicate verified facts and practical instructions, then restore systems only after the weakness is fixed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
