Been hacked? What to do in the first hours of a cyber attack

The first hours are when irreversible mistakes get made. The five most expensive ones:

• Paying the ransom without advice. It guarantees nothing, does not stop publication of exfiltrated data, may carry legal implications depending on the group behind the attack, and marks you as a payer. It is a business and legal decision to be taken with information — not a panic reaction.
• Reformatting, reinstalling or restoring backups "to get back up quickly". You destroy the evidence that explains how they got in and, if the entry vector remains open or the backup was already compromised, you get reinfected with the job half done. You restore once eradication is verified — not before.
• "Trying things" on affected systems. Ad-hoc antivirus sweeps, deleting suspicious files, running hastily downloaded clean-up tools: every action alters timestamps and artefacts that forensic analysis needs intact.
• Coordinating the response over compromised corporate email. If the attacker controls the mailbox, they know what you have detected, what you plan to do and when. Clean channels, always.
• Hiding the incident. Besides aggravating legal liability where personal data is involved, internal silence delays containment. Incidents get managed; secrets get discovered.

Ransomware adds decisions of its own to the list above. Besides isolating without powering off:

• Photograph the ransom note — in full, with the victim ID and the contact addresses — and note the extension of the encrypted files. That is how the ransomware family gets identified, along with its known techniques and whether a public decryptor exists.
• Do not negotiate blindly. Do not enter the attacker's chat "just to see what they want": every message gives away information and starts pressure clocks. If negotiation ever happens, it happens with professional advice and a defined strategy.
• Verify the real scope of the encryption. Which servers, which shares, which endpoints. And face the uncomfortable question: today's groups usually exfiltrate before encrypting (double extortion), so you must look for signs of data theft, not just of encryption.
• Check your backups without connecting them to the compromised network. Attackers try to encrypt or delete backups before launching the encryption. Verify their integrity from a clean environment: the state of your backups is the variable that shapes everything else.

Here is what this looks like in practice: in our real case of ransomware response at a law firm, early containment and verified backups made it possible to restore operations without paying the ransom. It is not always possible — but the first hours decide whether it is.

While the technical team contains, someone has to watch the legal clock. The essentials in Spain:

• AEPD — 72 hours if personal data is involved. If the breach affects personal data, Article 33 of the GDPR requires notifying the Spanish data protection authority (AEPD) within 72 hours of becoming aware of it, unless the breach is unlikely to pose a risk. Notification may be phased if you do not yet have all the information. If the risk to the individuals affected is high, they must be informed as well.
• INCIBE-CERT and the 017 helpline. INCIBE-CERT is Spain's reference incident response centre for businesses and citizens; you can report the incident and get free guidance through the 017 helpline.
• Police report where a crime has been committed. A cyber attack usually involves a criminal offence: you can report it to the cybercrime units of the Policía Nacional or the Guardia Civil. The report is also, in practice, usually required for the cyber insurance claim.
• NIS2, DORA and ENS, depending on your sector. If you operate in essential or important sectors (NIS2), are a financial entity (DORA) or work for the Spanish public sector (ENS), additional notification obligations to the competent authority or reference CERT may apply. Verify which ones with your legal counsel.
• Your cyber insurer — as early as possible. Policies set deadlines and sometimes panel response providers. Late notice can jeopardise cover — we explain this in our cyber insurance guide for businesses.

Why the timeline matters. Every one of these obligations requires explaining what happened, when it became known and what was done. The timeline and the evidence you preserve in the first hour are exactly what you will be asked for afterwards.

Call a DFIR (digital forensics and incident response) team if any of these is true: encryption is in progress or complete, you suspect data theft, privileged accounts are compromised, you cannot determine the scope with your own means, or you have notification obligations that require a defensible investigation. In practice: if you are wondering whether you need one, you need one.

What a professional team — ours included — does when activated:

• Containment with judgement. Isolating what needs isolating (and no more), cutting the attacker's communications and stopping the spread without taking the whole business down or trampling the evidence.
• Forensics with a chain of custody. Acquiring disk and memory images, preserving logs and reconstructing the timeline: entry vector, lateral movement, accounts used and data affected. All with a documented chain of custody, so the evidence stands up before the AEPD, the insurer or a court — the same rigour we apply in the expert work of our digital forensics service.
• Eradication. Removing the attacker's persistence mechanisms, accounts and backdoors, closing the entry vector and verifying no active presence remains before rebuilding anything.
• Verified recovery. Restoring in waves starting with what is critical, validating each system before returning it to production, with post-incident hardening so the same route does not work twice.

Hard2bit has been responding to incidents for Spanish businesses since 2013, with an in-house DFIR team and a standard we also hold ourselves to: we are ISO 27001 certified and accredited under Spain's ENS at the High category. We do not promise miracles; we promise method, evidence and honesty about what can be recovered. You can activate us on demand through incident response, or have the team already under contract with the IR retainer.