Nobody thinks it will happen to them, right up until the morning it does. A staff member clicks something they should not have, a supplier’s account gets spoofed, or a screen lights up with a message you really do not want to read.

The first 24 hours matter more than almost anything else. Not because you need to panic, but because a calm, ordered response in that window is what limits the damage and gets you back on your feet.

The first hour: contain, do not delete

The instinct is to start deleting things and pulling plugs. Resist it. Disconnect affected machines from the network so anything nasty cannot spread, but leave them switched on where you can. Powering off can wipe useful evidence and, with some attacks, make recovery harder.

Then tell someone who can actually help. If you have an IT partner, this is the call you make first, before you touch anything else.

The first few hours: understand what you are dealing with

Is this ransomware, a compromised email account, or a false alarm? The response is different for each. This is where having someone who can read the situation calmly earns their keep. Change passwords for any accounts you think are affected, from a device you know is clean, and turn on multi-factor authentication anywhere it is not already.

Resist the urge to pay anything or reply to anyone. That is a decision for later, with proper advice.

The first day: recover from a known-good backup

This is the moment your backup strategy either saves the day or lets you down. A good, tested, off-site backup means you can restore to a point before the attack and carry on. A backup nobody has ever tried to restore from is where a lot of businesses come unstuck.

Keep a simple record as you go: what happened, when, and what you did. If personal data may have been involved, you may have reporting duties, and a clear timeline makes that far easier.

The honest bit

The businesses that come through this well are almost never the ones with no problems. They are the ones who prepared: proper backups they had actually tested, a plan people knew to follow, and someone to call who did not flap.

If you are not sure your business could weather a bad morning like this, that is worth sorting before you need it, not after.

We do IT, so you don’t have to.