What should you do if you are hit by a cyberattack?

It’s a regular Tuesday morning, and systems are running smoothly. Then, within seconds, everything changes. A screen locks, documents disappear, or strange messages appear. It could be ransomware, an active intrusion, or a cyberattack whose scope you don’t yet understand.

In such a situation, every minute counts. But what matters most is not time itself, but what you do – and don’t do – in the first few minutes. Many instinctively unplug systems, reinstall software, or delete suspicious files. While that might stop some immediate damage, it can also erase critical evidence and make it much harder to understand what happened.

Sicra’s Security Operation Center (SOC)
handles incidents like these regularly. We see how much difference proper first-hand handling makes. Here are practical steps that help you support the security team and restore normal operations faster.

Stay calm and preserve the situation

The panic that arises when a cyberattack is discovered is natural. But the most important thing in this phase is to avoid rash decisions. If the attack is not at immediate risk of spreading further, systems should remain powered on. Shutting them down straight away risks losing evidence that could reveal how the attack started, how the attacker gained access, and what data is affected.

Scenario: An employee notices a strange message saying files have been encrypted. In panic, they switch off the computer. When SOC arrives, crucial memory traces that could have shown how ransomware entered are gone. If temporary storage (data in memory) had been preserved, SOC would have had far better conditions to reconstruct the attack and implement the right security controls.

SOC relies on traces like log files, memory data, and temporary processes to build an accurate picture of the incident. Without them, analysis becomes like putting together a puzzle without the key pieces.

Report quickly – but accurately

Speed is critical, but precision is equally important. Alerting the right people quickly can mean the difference between a limited problem and a full crisis. Notify key internal roles first: IT, the security manager, and leadership. Then, reach out to external partners such as Sicra’s SOC and suppliers of critical systems.

Scenario: A company discovers an attack late Friday evening. Instead of trying to fix it internally, they immediately notify leadership and SOC. This allows us to respond quickly, limit damage, and avoid mistakes that could make the situation worse.

A good notification list is one of the most valuable documents you can have. It should be updated, easily accessible, and tested regularly. When the alarm goes off, you should know exactly who to call – without scrambling for contact details.

Document every detail

In the chaos following an attack, details are easy to forget. Record the time of the first observation, describe what happened, and log all actions taken. Capture screenshots and secure logs. Even small details may prove critical in the later investigation.

Scenario: A security officer notes that an unknown file appeared on the server at 1:15 p.m., and that the system was isolated ten minutes later. This documentation helps SOC track the attack path and establish a clear timeline.

Documentation is not only vital in real time – it may also be important for legal assessments, cyber insurance claims, and regulatory reporting.

Isolate without destroying evidence

If a system is compromised, disconnect it from the network to prevent further spread. But avoid shutting it down or reinstalling software. The device is a potential source of evidence. When SOC gains access to it in its original state, we can collect the right data to identify malicious code, analyze the attacker’s methods, and understand the full scope of the breach.

Scenario: A company disconnects a compromised server from the network but leaves it powered on. When SOC arrives, we can extract the necessary data and stop further damage – without losing evidence.

Use secure communication channels

If your email or chat systems may be compromised, don’t use them to discuss the incident. Attackers often monitor communication to adapt and evade detection. Instead, use phone calls, encrypted messaging apps, or other channels approved for crisis communication.

Scenario: A company coordinates their response through email during an attack. The attackers monitor the thread and delay the response. When the company switches to secure channels, they can coordinate effectively without tipping off the intruders.

Follow the incident response plan if you have one

A good response plan is more than a document – it’s a practical tool that’s known, trained, and easily accessible. If you have one, follow it step by step. If not, this guide can be a temporary fallback, but we strongly recommend developing a tailored plan with security experts.

Scenario: A business with a well-established incident response plan quickly regains control of a security incident. Another without a plan loses valuable time figuring out what to do and who to contact.

Trust the process

Once SOC has been alerted, we will act swiftly to contain the damage and begin investigation. Our efficiency depends on the situation being as untouched as possible when we take over. We have the methods, tools, and experience to act quickly and accurately – but we need the necessary evidence to do so.

Collaboration saves time and money

A cyber incident is not just a technical problem – it’s a strategic challenge that impacts the whole organization. When employees know how to respond smartly from the start, SOC gains a far better starting point to do its job.

Sicra’s Security Operation Center monitors, analyzes, and responds with a documented end-to-end process. But it’s the collaboration with you as a customer, and the quality of the information we receive, that often determines how quickly we can restore operations and reduce the impact.