How to Respond to a Cyber Attack: Step-by-Step Guide for Small Businesses

When the words "The security of this network has been compromised" appear on your screen on a Tuesday afternoon, your first instinct is to panic. Your employees can't access files, payments are down, your business is in danger. Your second instinct is to call someone outside your company.

Dealing with a cyberattack right now?

You don't have to figure out the next steps alone. Contact Premier Technologies for help assessing the situation and determining what to do next.

Contact Our IT Support Team

The reality is the first hour after a cyber attack can determine whether you recover in days or weeks. If your network is under attack right now, start by prioritising containment, protecting critical systems, and contacting qualified IT or cybersecurity support.

Not dealing with an incident? Don't wait for one to create a response plan. Use this guide to understand the incident response process and prepare your business before an attack disrupts operations.

What Should You Do in the First Hour After a Cyber Attack?

Your actions in this first hour determine how much damage the attacker can do and how quickly you'll recover. Here's what needs to happen:

1. Stay calm and confirm the incident

   Rule out a system malfunction or false alarm. Signs of a cyber attack include:

   • Unusual network traffic
   • Locked files with a .crypto extension
   • A ransom note
   • Accounts lock out

2. Isolate affected systems

   Unplug network cables, disable wi-fi if you can do so safely. This stops the attacker from accessing other systems on your network and prevents them from spreading malware further. If you can't identify specific systems, take a conservative approach. Get professional guidance before making broader changes.

3. Stop using potentially compromised accounts

   If an email account, administrator account, or other login has been compromised, take steps to revoke access, reset credentials, and review authentication settings. If you suspect financial transactions or bank details may be compromised, contact your bank using official phone number or website.
   Use separate, trusted devices to contact the relevant service provider or a cybersecurity professional for guidance on securing your accounts.

4. Document what you know

   You don't need technical skills to document the incident. Record:

   • When the issue was discovered.
   • What users observed or received.
   • Which devices, accounts, applications or processes are affected.
   • What actions have already been taken.
   • Keep systems on to preserve evidence.

5. Secure your backups

   If you have recent backups, don't rush to restore your files until a qualified professional has assessed whether it's safe. Having a backup is important, but you also need to know that it is clean and usable before relying on it to recover your business data.

How Do You Quickly Respond to Ransomware Attacks?

Ransomware is the most common attack targeting small businesses. Your response to ransomware is slightly different from other attacks because time pressure is the attacker's entire strategy.

Immediately isolate the affected system. Ransomware spreads by copying itself across network shares and encrypting everything it can reach. The longer it runs, the more of your data gets encrypted. Disconnect the affected computer from the network immediately. If you can't identify which computer first, disconnect the most critical systems first (file servers, backup servers, payment systems) and the employee's individual computers second.

Do not pay the ransom. Paying does not guarantee data recovery. Many attackers provide decryption keys that don't work or work partially. Paying funds criminal operations and makes you a target for future attacks. The FBI and CISA both recommend against payment. Your insurance company will likely advise the same.

Focus on restoration from backup. Once the ransomware is contained, your fastest path to recovery is restoring your systems from a clean backup. This is why maintaining tested offline backups is critical. If your backups are online and connected to your network, ransomware can encrypt them too. Your backups need to be isolated from your production network.

Verify the backup is clean before restoring. Before you restore a system from backup, confirm the backup was made before the attack began. If you restore from a backup that's already infected, you've just re-infected yourself.

Getting ahead of the risk? Here's how to prepare your business with an incident response plan, clear responsibilities, and procedures your team can follow under pressure.

When Should You Notify Customers After a Cyber Attack?

Customer notification is required by law in most jurisdictions when a cyber attack compromises personal information (names, addresses, payment card data, Social Security numbers, health information). The timeline and content of your notification matter.

• Check your legal obligations
• Determine what data was actually compromised
• Create a clear, honest notification message
• You can offer credit monitoring or identity protection services
• Designate one contact person for all customer communications

Bring in professional incident response immediately if:

• The attack affected critical business systems (file servers, payment processing, email).
• The attacker encrypted your data (ransomware).
• Multiple systems are compromised.
• You're unsure how the attack happened or whether it's contained.
• You don't have current backups.
• Personal data may have been compromised (legal risk).

Why an Incident Response Plan Matters Before an Attack Ever Happens

An incident response plan is a documented process your organization follows when a cyber attack occurs. An incident response plan does three things:

1. Assigns roles and responsibilities so everyone knows what they're supposed to do when the alert comes in.
2. Outlines the steps you'll take to contain, investigate, and recover from the attack.
3. Documents your communication plan so you notify the right people at the right time in the right way.

IBM reports that companies with a response team and formal plan reduced average breach costs by approximately $474,000. For small businesses operating on thin margins, that can mean the difference between staying in business and closing the doors.

What Are the Five Phases of Incident Response?

Incident response follows a predictable structure. Understanding these phases helps you know what comes next and why each step matters.

Phase 1: Preparation

This is where you build your incident response team, create your response plan, configure monitoring tools, maintain backups, and train your staff. For small businesses, preparation means knowing who to call (your IT person, a managed services provider, law enforcement, legal counsel), what your backup strategy is, and whether your most critical systems are protected with multi-factor authentication.

Phase 2: Detection and Analysis

This is the moment you realize something is wrong. This might be an alert from your security software, an employee reporting suspicious activity, locked files on a production server, or a ransom note. Your job in this phase is to confirm that an actual attack occurred, understand what systems are affected, and determine how serious the situation is.

Phase 3: Containment

You need to stop the attack from spreading further. If ransomware is encrypting files on one server, you disconnect that server from the network immediately. If an account has been compromised, you reset the password and revoke its access. Containment is about isolation: separating the infected systems from the rest of your network so the attacker can't move laterally through your company.

Phase 4: Eradication and Recovery

This process removes the attacker's presence and restores your systems to normal. This might mean running malware removal tools, patching the vulnerability the attacker exploited, rebuilding compromised systems from backup, or restoring from clean copies. It's the longest phase and often requires specialized expertise.

Learn more: Create a Disaster Recovery Plan for Your Business

Phase 5: Post-Incident Review

This needs to happen after the immediate crisis is over. You document what happened, why it happened, and what you'll do differently next time. This phase determines whether you fix the root cause or simply treat the symptom.

How Do You Create an Incident Response Team for Your Small Business?

Most small businesses don't have a dedicated security team, so you create an incident response team from the people you already have. It doesn't need to be a 100-page document. A 1 to 2-page guide covering these sections is sufficient:

• Incident Detection and Reporting: How employees report suspicious activity. What symptoms indicate an active attack. Who needs to be notified.
• Immediate Response Steps: The four-phase containment sequence (confirm, isolate, document, activate team). What can be done immediately vs. what requires waiting for the IT specialist.
• Roles and Responsibilities: Who owns each decision. Who communicates with law enforcement. Who notifies customers. Who handles the technical work.
• Communication Plan: Internal communication (employees), external communication (customers, vendors, partners), and regulatory notification (if personal data is affected). What information goes to whom, in what order, and when.
• Recovery Process: How and when systems will be restored. What the restored system checklist is (security patches, password resets, access control audits). How you'll verify systems are clean before bringing them back online.
• Resources and Contacts: Incident response team members' contact information (personal phone numbers, not just office lines). Your cyber insurance company's 24/7 hotline. Law enforcement contacts.
  Your= should identify your external resources before you need them. This means choosing a managed IT services provider, a law enforcement contact, cyber insurance support now, and not during a breach.

Keep this document updated, and make sure at least two people have access to it (not just on your main server, which might be down when you need it).

Read more: Cybersecurity Policy for Small Business: Why You Need One and How to Use It

FAQ

Q: How fast does ransomware encrypt files?
A: Ransomware can encrypt thousands of files per minute once it's running. Every minute an infected system stays connected to your network increases the damage. Isolation must happen within minutes, not hours.

Q: What should I do if I receive a ransom demand?
A: Document it and report it to law enforcement. Contact your cyber insurance company. Do not respond to the demand or attempt to negotiate. Legitimate incident response firms and law enforcement can advise on next steps.

Q: Do I have to notify law enforcement after a cyber attack?
A: Not always required, but often advisable. FBI and local law enforcement track attack patterns and can sometimes help identify the attackers. Your insurance company may recommend it. Your legal counsel can advise on your specific situation.

Q: What if I don't have backups?
A: Recovery becomes much harder and more expensive. You'll likely need to pay for professional data recovery services, which can cost tens of thousands of dollars. This is why backup strategy is critical preparation before an attack.

Q: How long does recovery typically take?
A: For ransomware with backups, 1 to 3 weeks. For attacks without current backups, 1 to 3 months. For complex attacks requiring forensic investigation, several months. Time depends on the extent of compromise and your backup quality.

Q: Should my small business invest in incident response planning if we can't afford a lot of security?
A: Yes. Incident response planning is one of the highest-ROI security investments for small businesses. A one-page plan and a list of contacts costs almost nothing but cuts recovery time and costs significantly.

Q: Can I recover from ransomware without paying?
A: Yes, if you have clean backups. Backups are your ransomware insurance. Restoration from backup is faster and cheaper than paying and decrypting, and it doesn't fund criminals.

A cyber attack on a small business is not a matter of if but when. The difference between companies that recover quickly and those that suffer weeks of downtime is preparation. An incident response plan takes a few hours to create and costs almost nothing. It's the insurance policy that lets you contain damage, communicate clearly, and recover fast. Start building yours today, before the Tuesday afternoon when the alert comes in.