The First 48 Hours After a Cyber Attack: What to Do and in What Order

If your business has just suffered a cyber attack, this is the correct order: first contain it (isolate the affected devices without deleting anything), then notify (your insurer or broker and whoever handles your IT), then document and assess what's been affected, and only then restore and communicate externally. The first few hours determine how long the disruption lasts, how much it costs and whether the insurance can act with all its tools. This guide is written for SMEs and the self-employed who don't have an IT department and need to know what to do right now.

First things first: how to recognise an attack

Not every incident starts with a screen demanding a ransom. These are the most common warning signs in a small business:

• Files that won't open or that have changed name or extension.
• Customers or suppliers telling you they've received emails from you that you didn't send.
• Passwords that stop working, or login alerts from unfamiliar locations.
• Bank account activity that nobody recognises.
• Your management software or online shop stops working with no explanation.

If in doubt, treat it as an incident. It's much cheaper to rule out a false alarm than to react too late to a real attack.

Hour 0 to 2: contain without destroying evidence

The goal in these first hours is to stop the problem spreading, without erasing the trail that the technicians and the insurer will need afterwards.

1. Disconnect the affected devices from the network. Unplug the network cable or turn off the wifi. If you suspect the attack is spreading, disconnect the internet router as well.
2. Don't delete, format or reinstall anything. However tempting it is to "clean up" the computer, doing so destroys the evidence of how the attacker got in and can complicate the handling of the claim.
3. Don't contact the attacker or reply to ransom messages. Any negotiation must be handled by experts, with the insurer's knowledge.
4. Disconnect any backups that are connected to the network or to an affected device, so they don't get encrypted too.
5. If money is at stake, call your bank immediately. The sooner you try to stop a transfer, the better the chances of recovering it.

Hour 2 to 6: notify the right people

With the incident contained, it's time to bring in help. The order matters:

1. Your insurer or your broker. If you have cyber security insurance, the policy states the channel for reporting an incident, which is often a dedicated helpline. Call before hiring any technician on your own: the policy includes access to cyber security experts to restore your systems, as well as to lawyers and communications specialists. If you act independently, some costs may not be recognised.
2. Your IT provider, if you have one, so they can coordinate with the team the insurer assigns.
3. Your team. Explain briefly what's happened and what they shouldn't do: don't turn on devices that are switched off, don't plug in USB drives, don't open email from the affected computers. Do this by phone or in person, not from an email account that may be compromised.

If you don't have cyber insurance, you can look for guidance from public cyber security support services and a trusted IT professional. Either way, notify your broker too: another policy, such as legal expenses insurance, may help in part.

Hour 6 to 24: document and assess the scope

While the technicians work, your task is to gather information and start writing everything down. This will help with the insurer, with a possible police report and with decision-making.

• Open an incident log. Hour by hour: what was detected, who saw it, what was done and who was spoken to.
• Take photos of the screens showing ransom messages, warnings or errors, and keep suspicious emails without forwarding them.
• Identify what data may have been on the affected devices: customers, employees, patients, banking details. This determines whether anyone needs to be notified.
• Keep proof of all expenses: overtime, technicians, urgent purchases. These will form the basis of the claim.
• Note down which activity is halted and since when, to calculate the loss from business interruption later.

If personal data has been affected

When an attack compromises customer or employee data, data protection rules may require you to notify the supervisory authority, and in some cases those affected, within very short deadlines that can start running from the moment you become aware of the breach. This is where the policy's legal advice cover is most useful: lawyers assess whether there's an obligation to notify, what to say and how. If you don't have insurance, consult a lawyer or your data protection officer as soon as possible.

Filing a police report

Filing a report with the Police or the Civil Guard is usually advisable, especially if money has been diverted or there's extortion involved. Your bank and insurer may ask you for a copy. Bring the incident log and screenshots: they make the process much easier.

Hour 24 to 48: restore and communicate externally

With the attacker out and the scope clear, it's time to return to normal. Do this following the technicians' guidance, not on your own:

1. Restore from clean backups. Before restoring a backup, check that it isn't infected. If there's no backup, data recovery comes into play.
2. Change passwords from a clean device, starting with email, banking and management software. Enable two-factor authentication wherever possible.
3. Tell customers and suppliers what they need to know, especially if they may have received fraudulent emails in your name. A clear, timely warning stops someone paying a fake invoice.
4. Check your bank accounts and any payments scheduled for the coming days.

How to communicate without making things worse

Poor communication can do more damage than the attack itself. A few guidelines:

• Stick to facts, not assumptions. "We've suffered a cyber incident and are working with specialists" is better than giving details that later turn out to be wrong.
• Don't blame anyone publicly, whether an employee or a supplier. Responsibility is assessed later.
• One spokesperson only. Customers and suppliers should always get the same message.
• Check before publishing. If your policy includes legal advice and reputation management, use it before sending statements or posting on social media.

Summary table of the first 48 hours

Time	Goal	Key actions
0 to 2 hours	Contain	Isolate devices, don't delete anything, don't talk to the attacker, call the bank if payments are involved
2 to 6 hours	Notify	Insurer or broker, IT provider, internal team
6 to 24 hours	Document	Incident log, screenshots, affected data, expenses, police report
24 to 48 hours	Restore and communicate	Clean backups, new passwords, notice to customers and suppliers

Mistakes that make a cyber attack more costly

• Reinstalling everything the same day. This destroys evidence and sometimes the attacker is still inside because no one worked out how they got in.
• Paying a ransom on your own. It doesn't guarantee you'll get your data back, and it can leave you without cover.
• Notifying the insurer late. The policy sets out how and when to report the incident; complying with this is part of your obligations.
• Forgetting about the supplier. If the attack comes from a technology provider, your policy may cover the disruption if it's included; note this from the very first moment.
• Not keeping invoices or hours worked. What isn't documented is hard to claim for.

Get ready today so you don't have to improvise tomorrow

Everything above works much better if it's planned in advance. Spend a morning on this list:

• Write down on paper, away from the computer, the incident phone number from your policy, your broker's number and your IT contact's number.
• Check that you have backups disconnected from the network and that you've tested restoring them at least once.
• Decide who coordinates an incident and who talks to customers and suppliers.
• Review what your policy covers. If you're not sure what's included, we explain it in what a cyber risk insurance policy covers.
• If anything changes, such as more remote working or personal devices, report it. We explain this in cyber security and remote working.
• Set up a procedure to verify any change of bank account by phone, the way in for CEO fraud and fake invoices.

How we can help at Retuerto y Asociados

If you're a client and you suffer an incident, call us: as brokers we defend your interests with the insurer from the moment the claim is opened until the file is closed, and we help you communicate through the right channel. You'll find useful phone numbers in assistance phone numbers and the rest of our tools in assistance. If you don't yet have cyber security insurance, tell us how your business works via contact and we'll prepare a comparison for you.