What Happens When Your Business Gets Hacked? A Practical Guide to the First 24 Hours

At 7:40 on a Monday morning, the office manager at a 40-person architecture firm in Dallas opens a project folder on the shared server and finds that none of the files will open. Every filename now ends in an unfamiliar extension, and a text file in the folder explains that the firm's data has been encrypted. A set of construction documents is due to a client on Friday.

The firm is fictional, but the situation is realistic. Ransomware, compromised email accounts, and fraudulent payment requests affect businesses of every size, and they rarely announce themselves clearly. It might start with an employee who can't open files, a client asking about an unusual email from your company, or an accounting transaction no one recognizes.

What happens over the next 24 hours can influence how far an attack spreads, how quickly the business recovers, and how much disruption it experiences.

Business leaders don't need to become cybersecurity experts overnight. They need to know who to call, what to leave alone, and which decisions require their attention.

Here's how that first day should unfold.

During the first 24 hours after a cyberattack, businesses should focus on containing the threat, preserving evidence, securing compromised accounts, assessing business impact, involving the appropriate response professionals, and planning a safe recovery. Leadership should coordinate decisions and communication while qualified technical responders manage investigation and containment.

The timeline below illustrates how priorities may evolve during the first day. In an actual incident, investigation, containment, legal coordination, and recovery planning often happen simultaneously, and the sequence depends on the circumstances.

The First Hour: Contain the Threat

Call Your IT and Security Team Before Anyone Tries to Fix Anything

The office manager's first call should go to the firm's IT provider or internal security contact.

Waiting to confirm every detail can cost valuable time. Unusual account activity, unexpected password resets, suspicious emails sent from employee accounts, or files that suddenly won't open are all reasons to escalate a potential incident.

The response team's immediate responsibility is to determine what's happening, identify which systems may be affected, and coordinate steps to prevent further damage.

How quickly that process begins depends partly on the protections already in place.

A business with managed cybersecurity services that include 24/7 security monitoring and managed detection and response (MDR) may already have security analysts reviewing suspicious activity when an employee reports a problem.

Because an established security partner has familiarity with the client's environment, the investigation can begin with useful context rather than requiring everyone to understand the network for the first time during an emergency.

For a business without that coverage, the first challenge may be finding someone available, providing access, and explaining how its systems work while the incident is still unfolding.

Isolate Affected Systems Without Destroying Evidence

If malware or ransomware is involved, compromised devices may need to be disconnected from the network to prevent the attack from spreading to other computers and shared systems.

However, disconnecting a device is different from shutting it down.

Powering off a compromised computer can erase information stored in memory that investigators may need to understand how the attacker gained access and what happened afterward.

The CISA #StopRansomware Guide recommends isolating affected systems first. If a device cannot be disconnected from the network and remains a threat, powering it down may be necessary to stop the spread, even though some evidence could be lost.

With appropriate endpoint detection and response (EDR) capabilities in place, a security team can often isolate affected devices remotely. That allows trained responders to take containment actions without requiring employees to troubleshoot potentially compromised computers themselves.

At the architecture firm, the instruction to employees should be clear: stop accessing affected systems, avoid restarting or deleting anything, and wait for guidance from the response team.

Establish a Trusted Communication Channel

If company email or Microsoft Teams may be compromised, those platforms should not automatically be trusted for coordinating the response.

An attacker with access to an employee's mailbox could potentially read internal discussions about the investigation.

Instead, the business should use verified phone numbers or another approved communication method outside the affected environment.

Leadership should also establish clear responsibilities.

At the architecture firm, a managing principal might coordinate employees and client communications while the IT provider leads the technical investigation.

This allows the business to continue making decisions without creating confusion about who's responsible for what.

Hours 1–4: Understand What Happened and What's at Risk

Once the immediate threat is being contained, the next priority is understanding how far the incident may have reached.

The response team should investigate affected accounts, devices, applications, and information. That may include employee email, Microsoft 365, cloud applications, financial platforms, file shares, and other essential business systems.

For the architecture firm, the investigation begins with the project server. But it also needs to consider the accounting system, employee credentials, and email accounts used for client billing.

Not every suspicious event means the entire business has been compromised. Still, assuming an attack is limited to one computer before investigating can leave the organization exposed.

Secure Accounts and Access

Stolen credentials can allow attackers to regain access even after an infected device has been isolated.

Depending on the investigation, the security team may need to revoke active sessions, disable compromised accounts, reset passwords using trusted devices, and review administrative permissions.

These actions should be coordinated carefully. Making changes without a plan can interfere with the investigation or alert an attacker before containment measures are ready.

This is also where strong identity protections demonstrate their value.

Multifactor authentication makes stolen passwords less useful to attackers, although it doesn't eliminate every method of unauthorized access.

For businesses reviewing their existing protections, understanding why MFA is essential for business security is an important part of reducing account-related risk.

Start a Written Incident Timeline

Someone should begin documenting the incident as soon as possible.

That record should include when the problem was first identified, who reported it, which systems appear affected, and what actions have been taken.

Investigators, legal counsel, insurance providers, and potentially law enforcement may need this information later.

Details that seem obvious during the first hour can become difficult to reconstruct several days afterward.

A clear timeline helps everyone work from the same facts.

Hours 4–8: Protect Business Operations and Involve Outside Parties

By midday, the architecture firm's leadership is managing two responsibilities.

The security team is investigating the incident, but employees still have deadlines, clients still need answers, and the business still has work to complete.

Identify What Must Keep Working

Not every system carries the same operational importance.

For the architecture firm, access to current project files is a priority because construction documents are due Friday. Email and billing systems may also be essential.

Another business might prioritize scheduling software, production systems, customer records, or financial applications.

Leadership and the response team should identify which functions are most important and determine whether safe alternatives are available while the investigation continues.

That could mean using verified backup copies on trusted devices, temporarily changing how employees communicate, or speaking with a client about adjusting a deadline.

Any workaround needs to be evaluated carefully so it doesn't reintroduce compromised data or expose additional systems.

Businesses that have already identified their critical operations are better positioned to make these decisions without unnecessary delays.

Determine Whether Sensitive Information Was Involved

A cybersecurity incident and a confirmed data breach are not always the same thing.

An attacker gaining access to a system doesn't automatically mean confidential information was stolen. However, some ransomware attacks involve data theft as well as encryption.

The response team should investigate whether employee records, client information, financial data, credentials, or other sensitive materials may have been accessed or copied.

For the architecture firm, that might include confidential client plans, employee information, or financial records stored alongside project files.

Until the facts are reasonably established, leadership should avoid making definitive statements about what was or wasn't exposed.

Contact Legal Counsel and Your Cyber Insurance Provider

Many cyber insurance policies have requirements for reporting incidents promptly. Some also require businesses to use approved incident response providers.

Contacting the insurer early can help prevent unnecessary complications with coverage.

Legal counsel should also be involved when an incident may involve sensitive information, contractual obligations, or regulatory notification requirements.

For Texas businesses, those requirements deserve particular attention.

Under Texas Business and Commerce Code Section 521.053, businesses experiencing a qualifying breach involving sensitive personal information generally must notify affected individuals without unreasonable delay and, subject to statutory exceptions, no later than 60 days after determining the breach occurred.

When a reportable breach involves at least 250 Texas residents, notification to the Texas Attorney General is generally required as soon as practicable and no later than 30 days after determining the breach occurred.

Additional obligations may apply depending on the industry, the information involved, and other applicable laws.

These requirements don't mean every suspicious security event triggers a notification. They do mean that businesses should involve qualified legal guidance early rather than waiting until systems have been restored.

Report the Incident to the Appropriate Authorities

Businesses should also consider reporting cyber incidents to federal law enforcement and cybersecurity authorities.

CISA accepts cybersecurity incident reports, and the FBI accepts cybercrime complaints through the Internet Crime Complaint Center (IC3) or a local FBI field office.

Reporting can help authorities identify related attacks, investigate criminal activity, and share relevant threat information.

Your legal counsel and incident response team can help determine which reports are appropriate and whether any reporting is mandatory.

The important point is that reporting should be considered during the response, not overlooked until the investigation is finished.

Hours 8–24: Plan Recovery Without Rushing It

By evening, everyone wants systems back.

Employees want to return to their projects. Leadership wants a reliable recovery timeline. Clients want reassurance that their work is still moving forward.

But restoring systems before the threat has been addressed can create additional problems.

Confirm That the Threat Has Been Contained

Before affected systems return to normal use, the response team should investigate whether unauthorized access has stopped.

That may involve securing compromised accounts, identifying and addressing the entry point, checking for malicious software or persistence mechanisms, and validating that restored systems can be trusted.

In some incidents, determining the full extent of the compromise takes longer than 24 hours.

That's why recovery decisions should be based on evidence and a coordinated plan, not pressure to resume operations immediately.

A computer that appears to be working normally isn't necessarily secure.

Verify Backups Before Restoring Data

Reliable backups can make an enormous difference during a ransomware incident, but their value depends on whether they can actually be used.

Attackers may target backup systems as part of an attack, so the response team needs to verify that backup data exists, hasn't been compromised, and can be restored safely.

Restoration should take place in a trusted environment, with systems checked before employees resume normal work.

For the architecture firm, a verified backup from Sunday night could potentially preserve much of the work completed before Monday's attack.

The team would still need to evaluate what information was lost, which systems are safe, and how long restoration might take.

Rather than bringing every application online at once, recovery could prioritize the project files needed for Friday's client deadline.

This is where tested backup and recovery procedures become especially valuable. They give the business a clearer understanding of what's recoverable and what work will be required.

Handle Ransom Demands With Professional Guidance

If the incident includes a ransom demand, leadership may face pressure to make a quick decision.

Paying a ransom does not guarantee that encrypted information will be recovered or that stolen data will be deleted.

Payments can also involve legal and regulatory risks, particularly when sanctioned individuals or organizations may be involved.

Any decision should involve qualified legal counsel, the cyber insurance provider, and the incident response team.

A ransom demand should never become a reason to abandon the investigation or make an uninformed decision.

Communicate Clearly With Employees and Customers

Employees need to know which systems are safe to use, which activities should remain paused, and where to report anything suspicious.

Clients and business partners may also need updates depending on how the incident affects their information or services.

For the architecture firm, leadership may need to contact the client expecting construction documents on Friday.

That conversation should focus on confirmed facts, realistic next steps, and the firm's commitment to protecting the client's information.

It's appropriate to explain that an investigation is ongoing. It's less helpful to promise a recovery date that hasn't been validated or minimize an incident before its impact is understood.

Clear communication helps maintain trust when circumstances are uncertain.

Key Insight: The First 24 Hours Are About Control, Not Perfection

A business doesn't need to resolve every aspect of a cyberattack within one day.

It needs to establish control over the response.

That means getting the right people involved, containing the threat, protecting evidence, understanding business impact, and developing a safe recovery plan.

For the architecture firm, success during the first day may not mean every employee is back at work. It may mean the attack has been contained, critical information has been protected, the recovery team has a plan, and leadership can communicate responsibly with employees and clients.

Those outcomes depend on preparation, clear responsibilities, and experienced support.

The Best Cyberattack Response Starts Before an Attack

The first 24 hours are easier to manage when your business already knows how it will respond.

A few practical questions can reveal whether your organization is prepared:

• Who should an employee contact when something suspicious happens?
• Who has the authority to disconnect a system or suspend access?
• Where are critical backups stored, and when were they last tested?
• How would employees communicate if company email became unavailable?
• Who coordinates with legal counsel, insurance providers, and law enforcement?

If those answers aren't clear today, establishing them during an active incident will be much harder.

Preparation also means maintaining secure configurations, reviewing access permissions, monitoring for suspicious behavior, testing recovery procedures, and helping employees recognize potential threats.

That's why turning your staff into a cybersecurity asset is an important part of a broader security strategy.

Technology can detect and prevent many threats, but people and processes determine how effectively an organization responds when something unexpected happens.

How Mentis Group Helps Businesses Prepare

At Mentis Group, cybersecurity isn't an optional layer added to managed IT. It's integrated into how we manage, monitor, and protect our clients' technology environments. Our security-first approach combines layered protections, endpoint security, 24/7 Security Operations Center (SOC) monitoring, managed detection and response (MDR), Microsoft 365 security monitoring, and backup and recovery capabilities.

Just as important, these technologies are supported by specialized teams and established processes. Our Service Desk, Centralized Services, cybersecurity specialists, engineers, and CIO team work together to support the environment, identify risks, and coordinate appropriate action when an incident occurs. Through recurring Technology Alignment and CIO-led Strategic Business Reviews, we also help clients address vulnerabilities, understand business priorities, and plan improvements before an emergency.

When a security incident occurs, having an established technology partner provides valuable context. Mentis already understands the client's infrastructure, critical systems, and operational dependencies. We can coordinate with our security monitoring partners, client leadership, cyber insurance providers, legal counsel, and specialized incident response professionals as appropriate, helping ensure technical actions and business decisions remain aligned.

Formal incident response plan development, specialized forensic investigations, and other services outside the recurring managed services scope may require separately scoped engagements or qualified partners. Our role is to help clients understand those requirements, coordinate effectively, and avoid unnecessary confusion during a high-pressure situation.

That's the Mentis Way: combining proactive management, specialized expertise, cybersecurity, and business strategy to help organizations operate with greater confidence.

Be Prepared Before the Unexpected Happens

No business can eliminate every cybersecurity risk.

But businesses can prepare for the moments when something goes wrong.

The right combination of security protections, experienced support, tested recovery procedures, and clear communication can reduce uncertainty and help leadership make better decisions under pressure.

You shouldn't have to build your incident response plan for the first time during an emergency.

Let's talk about how Mentis Group can help you prepare, protect your operations, and build a more resilient business.

Schedule a Strategic Security Conversation

Frequently Asked Questions

What should a business do immediately after being hacked?

Contact your IT or cybersecurity response team, isolate affected systems, and preserve evidence. Avoid restarting devices, deleting suspicious files, or making uncoordinated changes. Disconnect compromised devices from the network where possible. If disconnection isn't possible and the threat continues to spread, powering down a device may be necessary under the response team's guidance.

Should a business shut down its entire network after a cyberattack?

Not necessarily. A security team should determine whether specific devices can be isolated or whether broader containment is required. Disconnecting affected systems can limit the spread of an attack while preserving valuable evidence. Shutting systems down may be necessary when other containment options aren't available.

How long does it take a business to recover from a cyberattack?

Recovery time depends on the type of attack, the systems affected, the extent of the compromise, and the organization's preparedness. Some incidents can be resolved within days, while serious ransomware attacks or data breaches may require weeks of investigation and recovery.

Does a business have to report a cyberattack?

Reporting requirements depend on the nature of the incident, the information involved, and applicable laws. In Texas, qualifying breaches involving sensitive personal information can trigger notification requirements for affected individuals and the Texas Attorney General. Reporting cybercrime to CISA or the FBI is also recommended in many circumstances. Legal counsel can help determine which obligations apply.

Does cyber insurance cover a cyberattack?

Coverage depends on the insurance policy, the circumstances of the incident, and whether the business has satisfied the policy's requirements. Many policies require prompt notification and may specify which incident response vendors should be involved.

How can Mentis Group help businesses prepare for cyberattacks?

Mentis Group helps businesses strengthen their cybersecurity through layered protection, continuous monitoring, SOC and MDR capabilities, endpoint security, and backup and recovery solutions. By connecting cybersecurity with proactive IT management and business planning, Mentis helps organizations reduce risk and prepare for disruptions before they happen.