The “Oh No” Moment

It starts with a glitched screen. Maybe your mouse stops moving. Or, in the worst-case scenario, a terrifying window pops up demanding Bitcoin to unlock your files.

Your stomach drops. Your heart starts racing. You have been hacked.

In that moment of panic, instinct takes over. You want to fix it. You want to make it stop. Most people do one of two things: they start clicking frantically to close windows, or they reach for the power button to restart the machine.

Stop.

Both of those reactions, while natural, could destroy your chances of recovering your data.

When a cyberattack hits, the first five minutes are critical. This is known as Incident Response. How you react now determines whether this is a minor headache or a business-ending disaster. Here is exactly what you need to do.

Step 1: Disconnect Everything (The Quarantine)

Imagine a virus spreading through an office building. The first thing you do isn’t “cure” the patient; it is to shut the doors so the virus doesn’t leave the room.

The same logic applies to your computer.

If you suspect malware, ransomware, or an active hacker, your immediate goal is containment. You need to cut the bridge between the infected computer and the rest of your business network.

• Pull the Plug: Literally. If you are using a wired connection, yank the Ethernet cable out of the back of the PC.
• Kill the Wi-Fi: If you are on a laptop, toggle the physical Wi-Fi switch off or turn on “Airplane Mode” immediately.

By disconnecting, you prevent the malware from “moving laterally”—that is, jumping from your computer to the server, the backup drives, or your colleague’s laptop. You are sacrificing one machine to save the fleet.

Step 2: Do NOT Reboot (Preserve the Scene)

This is the most common mistake small business owners make. We are trained that “turning it off and on again” fixes everything.

In a hacking scenario, rebooting is destructive.

Here is why: Computer experts and forensic teams need to see what is happening in your computer’s “short-term memory” (RAM). This is where the evidence lives. It shows what programs are running, what connections are open, and sometimes even the encryption keys needed to unlock your data.

RAM is volatile. The moment you cut the power or reboot, that memory is wiped clean.

If you turn off the computer, you are effectively wiping fingerprints off a crime scene before the police arrive. Leave the computer powered on, but disconnected from the internet, and walk away.

Step 3: Call the Professionals (Execute the Plan)

Once the machine is isolated, do not try to fix it yourself unless you are a cybersecurity expert. You might accidentally trigger a ransomware timer or delete recoverable files.

This is the moment where you open your Incident Response Plan.

Don’t have one? You aren’t alone—but you are at risk. An Incident Response Plan is a “break glass in case of emergency” document. It tells you exactly who to call, how to restore your backups, and how to legally notify your customers if their data was stolen.

Better Safe Than Sorry

Getting hacked is a question of when, not if. The difference between a company that survives a breach and one that goes under is preparation.

Do you have a plan in place?

If the answer is “no,” we need to talk. Don’t wait for the red screen of death to figure out your next move.

Need an Incident Response Template? Click here to download our free checklist and secure your business today.