Guide
What to Do If You Think You Were Hacked or Scammed
Act fast and keep evidence. The first hour matters more than knowing exactly what happened.
Why it matters
In the first hour, calm and simple steps protect your data, your evidence and your insurance coverage. Most of the damage in small organizations comes from waiting, wiping evidence or paying the attacker before anyone with experience is involved.
Step by step
- Disconnect the affected device from the network, but do not shut it down.
- Disable the account, reset its password and sign out all its sessions.
- Call your insurer hotline before hiring anyone, and your bank right away if money moved.
- Write down what happened, when, and what you did. Take photos of screens.
- Do not pay or reply to the attacker. Legal counsel decides who must be told.
Common mistakes
- Shutting the computer down, which can destroy evidence
- Hiring outside help before calling the insurer hotline
- Replying to or paying the attacker
- Not writing down what happened and when
Free tools for this
Incident Response Plan
Who to call and what to do in the first hour of a cyber incident.
Stop. Check. Report. Scam poster
Eight red flags and three steps. Print it and post it near desks.
A real case
One account, one gap
- Situation
- An agency I support had one employee account phished and taken over. No genius hacker, just one click and one account where MFA was not set up right. No control stops every click.
- What was done
- Contained it the same day, cleaned it up and closed the gap for every account. I knew their budget, so I did not charge.
- Result
- The account was secured, and the CEO heard it plainly: MFA is not optional anymore.
Questions people ask
What do we do first if we think we have been hacked?
Disconnect the affected device from the network without shutting it down, disable the account, call your incident lead and then your insurer hotline. Do not pay or reply to the attacker. The incident response plan lays it out on one page.
What is business email compromise, and how big is the risk?
A scammer takes over or imitates an email account, then asks for a payment, a bank detail change or gift cards. The FBI 2025 Internet Crime Report counted about $3 billion in reported losses from it in one year. The best defenses are cheap: MFA on email, DMARC, two people to approve payments, and a phone call to a known number before any bank change.
Not sure where to start?
One conversation and a straight answer about where your organization stands. No cost, no commitment, no pitch.