It is Monday morning, and the same ransom note is sitting on three screens. Or someone in accounting calls because their Microsoft account no longer opens and customers are receiving strange emails. At this moment, the quality of your firewall no longer matters. What matters is what happens in the next sixty minutes.
We respond to incidents at Swiss SMEs and keep seeing the same pattern: the damage is caused not only by the attack, but by what is done afterwards with good intentions and bad results. Devices get rebooted, traces get wiped, or nothing happens for an hour because nobody knows who decides. This article is the order we work through when it happens. Print it out and keep it somewhere you can find it without a computer.
Step 1: Stay calm, delete nothing, reboot nothing
The first impulse is almost always wrong. Do not close the ransom note, do not restart the machine, do not delete suspicious files, do not run the antivirus and let it clean everything up. Each of these actions destroys information you will need later to understand how the attacker got in and what they took with them.
Just as important: nobody contacts the extortionists, and nobody pays. Not on principle, but because that decision is not made in the first hour and not by the person sitting in front of the screen. Read how ransomware works today and why encryption is often only the final step.
Step 2: Isolate instead of shutting down
The affected device must come off the network, but it should stay switched on. Pull the network cable, disable Wi-Fi, done. The memory of a running computer holds traces that are lost for good the moment it powers off: which programs are running, which connections are open, sometimes even the key currently being used for encryption.
If several devices are affected or you do not know how far the attack has spread, disconnect the whole site or segment from the internet. That is drastic, but it stops data from leaving and cuts the attacker off from their systems. A day without internet is cheaper than a week without a company.
Step 3: Lock accounts and cut remote access
Most attacks run on valid credentials. So every account that could be connected to the incident gets locked: the affected person's account, all admin accounts, service accounts on the affected system. Locking means disabling and terminating active sessions, not just changing the password. An existing session often survives a password change.
Then look outward: VPN access, remote maintenance tools, access held by IT partners and suppliers. Anything not strictly needed is switched off for now. Attackers like to leave themselves a second way back into the network, and it often runs through an inconspicuous account nobody is watching.
Step 4: Preserve evidence
Photograph the ransom note with your phone, including the contact address shown on it. Write down which devices are affected, with names and times. If emails were the trigger, keep them instead of deleting them. Do not touch logs, do not empty the recycle bin, do not tidy up.
This sounds like a side issue, but it is the foundation for everything that follows: the analysis, the insurance claim, the report to authorities, and the question of whether customer data was stolen. What is not preserved in the first hour usually cannot be reconstructed later.
Step 5: Alert the right people
Now comes the question an emergency plan should have answered beforehand: who decides, and whom do we call? Internally, one person needs to take the lead, and that is not automatically IT. IT works on the problem; someone else coordinates, communicates and makes decisions.
Externally, the list includes your IT partner, an incident response partner if you have one, and your cyber insurer. The insurer early, not at the end. Many policies require the insurer to be informed within a few hours and give them a say in the choice of service providers. Skipping this puts your coverage at risk. If you have no standing partner, our Incident Response is the contact you can put on that list.
Step 6: Communicate outside the affected systems
If the attacker is inside your Microsoft 365 environment, they are reading your emails. Including the ones where you discuss how to get rid of them. From now on, all communication about the incident runs over channels that have nothing to do with the company network: phone, private mobiles, a messenger on private devices.
The same applies to the contact list from step 5. If it only exists on the intranet or in a mailbox, it will be encrypted or read along with everything else. A printed sheet in a drawer is not an old-fashioned idea; it is the only version guaranteed to work.
Step 7: Establish the scope and keep a log
Only now does the actual assessment begin. Which systems are affected, which are not? Which accounts were used? Are the backups reachable and intact, or were they encrypted or deleted too? Are there signs that data has left the company? These questions do not need complete answers in the first hour. But they need to be asked so the next steps have a basis.
In parallel, one person keeps a log: who did what and when, what was found, which decisions were made. Handwritten or on a clean device, in plain sentences with timestamps. This log is worth its weight in gold when the insurer, the authorities or management later want to know what happened. And it prevents the same things being done three times over in the chaos.
What comes after the first hour
The seven steps stop the bleeding. What follows takes days to weeks and needs specialists. That includes finding out how the attacker got in, because without that answer every recovery is a restart with the door left open. It includes a clean restore from backups that are proven not to be compromised. And it includes communication: to employees, to customers, to suppliers.
Do not forget the reporting obligations. Operators of critical infrastructure in Switzerland must report cyberattacks to the National Cyber Security Centre within 24 hours. If personal data is affected, the Data Protection Act requires notifying the Federal Data Protection and Information Commissioner when there is a high risk for those concerned. Even if you are not obliged to report, you should: the information helps other companies, and it costs nothing.
Preparation: the plan before the emergency
Everything described above is only achievable in the first hour if it has been thought through once beforehand. An emergency plan for an SME fits on two pages:
- Who decides? One person with a deputy, with names and mobile numbers.
- Whom do we call? IT partner, incident response partner, insurer with policy number, data protection advisor, police if needed.
- What do we switch off first? Which systems are critical, which can go offline?
- How do we communicate? Which channel when email and Teams no longer work?
- Where is the plan? Printed, and in a place outside the network.
Run through the plan once a year. At a table, in one hour, with a fictional scenario. You will find gaps, and that is exactly the point of the exercise. Cyber insurers now ask about this specifically, and a company that knows immediately what to do in an emergency saves days of downtime.
Conclusion
The first hour after an attack does not decide whether it happened, but it decides how expensive it gets. Those who isolate instead of shutting down, preserve traces instead of deleting them, and reach the right people instead of fighting alone hold the best cards.
Better still is detecting the attack before there is a ransom note. Attackers often move around a network for days before they strike, and that window is exactly where Spectacles comes in: it detects suspicious behaviour on endpoints and in cloud accounts and can isolate an affected system before the attack spreads. And if you want to know where your company stands today, a Security Health Check shows you the gaps with priorities, including whether your emergency plan holds up.