What to Do in Case of a Cyberattack (Step by Step)
Article Summary: If a cyberattack hits your business, the first hour matters most. Disconnect the affected devices from the network instead of powering them off. Call your IT provider by phone, and leave the evidence in place. If money went to a scammer, call your bank right away. This post lays out a step-by-step cyberattack response plan, plus where Washington businesses should report an attack.
If a cyberattack hits your business, what you do in the first hour really matters. It’s also the easiest time to make a costly mistake. You might turn off the wrong machine, delete evidence, or reply from an email account the attacker is already reading.
At Pacific Edge Technology, we help businesses across Richland, Kennewick, and Pasco prepare for and recover from attacks. The cyberattack response steps below tell you what to do, in order, so you’re not guessing in the moment. You don’t need any technical knowledge to follow them.
Before anything else: don’t make it worse
Before you touch anything, avoid these common mistakes:
- Don’t turn off the affected computer if you can avoid it. Disconnecting it from the network works better. Powering it down can wipe evidence that helps investigators figure out what happened.
- Don’t delete anything. Leave the ransom note, the suspicious email, and any alerts exactly where they are. Your IT team and investigators will need them.
- Don’t pay a ransom on the spot. That decision deserves careful thought, which we cover below.
- Don’t use hacked email or accounts to discuss the attack. If an attacker is in your inbox, they can read those messages. Switch to phone calls or a different account.
Your step-by-step cyberattack response
Work through these steps in order, starting the moment you notice something’s wrong.
- Disconnect the affected devices from the network. Unplug the network cable and turn off Wi-Fi on anything that looks affected. This stops the problem from spreading to other computers and your backups. CISA recommends isolating devices rather than powering them off. Only shut a device down if you can’t get it off the network any other way.
- Call your IT provider right away, by phone. Don’t email, in case the attacker is watching your inbox. If you have cyber insurance, call your insurer next. Many policies require you to involve their incident team early.
- Leave the evidence alone. Don’t wipe, reinstall, or clean up the affected machines yet. Screenshots of the ransom note or suspicious emails help, but keep the originals too.
- If money went out, call your bank immediately. Ask them to recall the transfer and freeze it if they can. With wire fraud, acting in the first few hours makes the biggest difference.
- Reset passwords from a clean device, and turn on multi-factor authentication. Start with email and any admin accounts. Use a device you know the attack didn’t touch.
- Report the attack. Reporting can help you recover, and the law sometimes requires it. See the next section for where to go.
Where to report a cyberattack
US businesses should report attacks to two federal agencies:
- The FBI: File a complaint with the Internet Crime Complaint Center (IC3).
- CISA: Report the incident to the Cybersecurity and Infrastructure Security Agency.
If you wired money to a scammer
Speed matters most here. The FBI asks victims to report wire fraud to IC3 as quickly as possible, ideally within 72 hours. That gives its Recovery Asset Team the best chance of freezing the money. According to the FBI’s 2025 IC3 report, the team froze about 58% of the money in the fraud cases it worked that year.
If customer or employee data was exposed
Washington has its own breach notification law. If an attack exposed personal information about Washington residents, you generally must notify those people within 30 days of discovering the breach. If the breach affects more than 500 Washington residents, you must also notify the Washington Attorney General within the same 30 days.
Other states have their own rules if your customers live elsewhere. Some industries, such as healthcare, face additional federal requirements. Talk to your lawyer or IT provider early so you don’t miss a deadline.
Should you pay the ransom?
If ransomware hit you, the big question is whether to pay.
The FBI does not recommend paying. Payment doesn’t guarantee you’ll get your files back. It also marks you as a business that pays, and the money funds more attacks.
The decision is ultimately yours. Make it with law enforcement, your IT or incident response team, and your insurer, not alone in the first panicked hour. Sometimes a free decryption tool already exists for the exact ransomware that hit you. That’s one more reason to bring in experts before you pay anyone.
The best time to prepare is before it happens
All of this gets much easier if you make some decisions in advance. You don’t need a thick binder. A simple cyberattack response plan should cover:
- Who to call first, such as your IT provider and insurer, with phone numbers stored somewhere you can reach without your main systems.
- Where your backups live, and proof that someone has tested them with a real restore.
- Which accounts and devices matter most, so you know what to protect first.
A single page covering those points is enough for most small businesses. It’ll save you a lot of scrambling if the day ever comes.
If you’re a Tri-Cities business without a plan, get in touch with Pacific Edge Technology. We’ll help you build a one-page cyberattack response plan and make sure your backups will actually work when you need them.
Cyberattack Response FAQs
What’s the first thing to do in a cyberattack?
Disconnect the affected devices from the network by unplugging the cable and turning off Wi-Fi. Then call your IT provider by phone. Getting devices off the network stops the problem from spreading while you get help.
Should I turn off my computer if I get ransomware?
If you can, disconnect it from the network instead of powering it off. Shutting it down can wipe evidence stored in memory. Only power a device off if you can’t disconnect it any other way.
Should I pay the ransom?
The FBI does not recommend it. Paying doesn’t guarantee you’ll get your data back, and it funds more attacks. Make the decision with law enforcement, your IT or incident response team, and your insurer. Check whether a free decryption tool exists first.
We wired money to a scammer. What do we do?
Call your bank immediately and ask them to recall the transfer. Then report it to the FBI’s IC3 as quickly as possible, ideally within 72 hours. In 2025, the FBI’s Recovery Asset Team froze about 58% of the money in the fraud cases it worked.
Who do I report a cyberattack to?
Report it to the FBI’s IC3 and to CISA. Also tell your cyber insurer. If the attack exposed personal information about Washington residents, you’ll likely need to notify them within 30 days, and the Attorney General too if more than 500 residents are affected.
This Article has been Republished with Permission from The Technology Press.
