What to Do After a Cyber Attack, Step by Step

What to do after a cyber attack comes down to five moves, in this order: stop the damage, keep the evidence, tell the right people, fix the way in, and only then go back to normal work. Most of the harm in a bad day does not come from the first mistake. It comes from the next hour, when people panic, delete things or stay quiet. This guide gives you the order, with the small details that make each step work.

It covers both a personal problem, such as a bad click or a stolen account, and a problem at work. The steps are the same shape. What changes is who you call. At home you call your bank or the service. At work you call the person your employer named for this, and you do it early.

One rule before everything else: your employer's incident procedure beats this page. If your company has a number to call or a form to fill, use it. Use this guide to understand why that procedure asks what it asks.

Recognise what counts as an incident

An incident is anything that may have exposed information, taken away access, or let a stranger act as you or your company. You do not need proof. You need a reason to doubt.

These are all incidents:

You typed a password into a page, then realised the page was not real.
A colleague's email account sends messages nobody wrote.
A laptop or phone is lost or stolen.
You sent a file to the wrong person.
A screen says your files are locked and asks for payment.
A payment went to a bank account that turned out to be false.
You see sign-in alerts for a place you have never been.

People often wait because they think "it may be nothing". Treat doubt as enough. A report that turns out to be nothing costs a few minutes. A report that comes a week late can cost a lot more.

After a bad click

Say you open a message that looks like a parcel notice. You tap the link. A page asks you to sign in. You type your email and password, and then the page just sits there. You now think it was fake.

Stop. Close the page. Do not enter anything else.
Change the password of the account you typed, from a different device if you can. Use a fresh, long password that you have never used elsewhere.
Change it everywhere you reused it. If the same password protects other accounts, those are open too.
Check the sign-in history of the account. Most services list recent devices and places. Sign out of any you do not know.
Turn on two-step sign-in if it was off.
Report it. At work, tell your security contact now, before you do more. At home, report the message as a scam inside your mail or messaging app.

If you only opened the link and typed nothing, the risk is smaller, but still tell the person who handles security at work. The same message probably reached other people, and your report helps them. For a fuller walk-through of this exact case, read what to do after clicking a phishing link on your phone.

After an account takeover

A takeover means someone else is using your account. The signs: you are locked out, your contacts get strange messages from you, settings changed, or you get codes you did not request.

Use the service's recovery page to get back in. Do not use a link someone sent you.
Set a new password, then sign out of all other sessions.
Check the recovery details. Attackers often add their own phone number or backup email so they can return. Remove anything that is not yours.
Check forwarding rules and filters in email. A hidden rule that forwards your mail to a stranger is a common leftover.
Tell your contacts that messages from the account may have been false. Keep the message short and do not click anything in it.
Check what the account can reach. If your email was taken, think about every account that uses it for password resets: banking, shopping, work.

At work, a taken-over work account is a business incident, not a personal one. Report it before you try to fix it alone. The security team may want to look at the account exactly as it is.

After a lost device

A lost phone or laptop is an incident even if it has a lock screen. The question is how fast you can cut the device off from your accounts.

Try to find it with the device's location feature, if it was set up before.
Lock it remotely and, if the owner of the device allows, wipe it.
Change the passwords of the most important accounts first: email, banking, work sign-in.
Tell your phone company so the SIM can be blocked.
Tell your employer at once if the device had any work data or work sign-in on it. Do not wait to see if it turns up.

Setting this up before the loss is much easier. Our guide on protecting your accounts first when a phone is lost puts the steps in the right order.

Preserve evidence

Evidence is whatever shows what happened: the message, the page, the time, the file, the screen. Without it, the people helping you are guessing.

Do not delete the suspicious message. Move it to a folder if it bothers you.
Take a photo of the screen with your phone. Do not rely on memory.
Write down the time and what you did, in order. Keep it plain: "I opened the link at about 10:15. I typed my work email and password."
Do not turn off or wipe a work computer unless the security team tells you to. Sometimes turning off removes information they need. Follow their instruction, and if you cannot reach anyone, follow the written procedure.
Keep the device as it is. Do not install cleaning software on your own.

For a personal scam, keep the receipts, chat logs, account numbers and web addresses. Your bank or the police may ask for them.

Report early at work

At work, the most useful thing you can do is speak early. Security teams can often stop the spread of a problem when they hear within minutes. Hours later, the options are fewer.

Know three things before you need them:

Who to tell. A name, a phone number or a mailbox. Save it on your phone.
What to say. Who you are, what you saw, when, and which device or account.
What not to do. Do not investigate by yourself. Do not warn the attacker. Do not post about it.

A good first report is short: "At 10:15 I clicked a link in a parcel message on my work laptop and entered my password. I closed the page and did not enter anything else. I have not changed anything yet." That is enough for the team to start. For a model message and the usual routes, see how to report a security incident at work.

Reporting a mistake should never be punished. A workplace where people hide errors is a workplace where small problems become large ones. If you manage people, say clearly that early reports are welcome.

When systems are down

Sometimes the attack takes away the usual channels: email, chat, the phone system, the shared drive. You cannot send a message to the security team through the very system that is broken.

Plan for this ahead of time:

Keep a printed or offline list of key contacts: the security contact, your manager, IT support, and the person who decides for the company.
Agree on a second way to reach people, such as personal mobile numbers kept by managers for this purpose, if your employer allows it.
Do not assume a message that arrives during an outage is real. Attackers sometimes send false "instructions" while everything is confused. Confirm by calling a number you already had.
Follow the paper or offline version of your job, if one exists. Some roles have a manual way to keep serving customers for a day.

The point is to stay in contact and stay calm without relying on the broken system.

Ransomware

Ransomware locks or scrambles files and asks for payment to give them back. The screen may show a note, or files may suddenly have strange names.

Disconnect the device from the network. Unplug the network cable or turn off Wi-Fi. This can stop the spread to shared drives. Do not shut the computer down unless told to.
Tell the security team immediately. Use the phone if needed.
Warn people nearby to stay off shared folders until told otherwise.
Do not pay or reply to the note. Payment is a decision for the company's leaders, advised by experts and the proper authorities, not for one employee.
Write down what you saw, and photograph the note.

If you run a team, remember that the decision to pay or not belongs to the organisation, and the rules about telling regulators or the police depend on your country and your sector. Your employer's procedure and the agency that sets the rules where you work are the guide. For the specific case of a locked work computer, read ransomware on a work computer: what do I do.

Restoring and reviewing

When the immediate danger is over, the order matters again. Going back too fast is how attackers return.

Restore from a backup you trust, and that has been tested. A backup that was never tried may not work.
Change the credentials that were exposed before reconnecting anything. If the attacker still has a working password, restoring the data changes nothing.
Check that systems are clean before they rejoin the network. This is the security team's decision.
Look after affected people. Customers and colleagues whose information was exposed need honest, clear notice, in the way your organisation's rules and the law where you work require.
Hold a review. Ask what happened, what helped, what slowed you down, and what will change. Keep it about fixing the process, not blaming a person.

A review is where the next incident gets cheaper. If the sign-in alert was ignored for a day, the fix may be a better alert. If nobody knew the phone number to call, the fix is a card in every desk drawer.

Common mistakes

Waiting to be sure. You rarely get certainty. Report on doubt.
Deleting the message. It is the best clue anyone has.
Fixing it alone at work. Changing things before the team looks can destroy evidence or tip off the attacker.
Changing only one password. If you reused it, the others are open too.
Trusting a "helper" who contacts you. After an incident, scammers offer to recover money or files for a fee. Contact only the real company or authority, using details you looked up yourself.
Paying the ransom note on impulse. This is never one person's decision.
Going back to work before the review. The same weakness is still there.

Quick reference

Situation	First action	Then
Bad click	Close the page, change the password	Report, check sign-in history
Account taken over	Recover through the real service	Remove unknown recovery details, tell contacts
Lost device	Lock it remotely	Change key passwords, tell employer
Locked files	Disconnect from the network	Call security, do not pay
Wrong recipient	Ask the sender to recall, tell your manager	Follow the data rules at work

Questions people ask

What is the very first thing to do after a cyber attack?

Stop doing the thing that may be causing harm: close the page, disconnect the device, or lock the account. Then tell the right person. At work that is your security contact, at home it is the bank or the service involved.

Should I turn off my computer after an attack?

Not by default. Disconnecting from the network is usually the safe first move, but turning the machine off can remove information the security team needs. Follow your employer's procedure, and ask if you are unsure.

Do I have to report a small mistake at work?

Yes. Small mistakes are exactly what security teams want to hear about, because the same trick often reaches many people. Reporting early is part of the job, and a good employer does not punish it.

Who decides whether to pay a ransom?

The organisation's leaders decide, with expert advice and in line with the law where you work. An individual employee should never pay or reply to a ransom note.

How do I know if my accounts are safe again?

Check the sign-in history, remove recovery details that are not yours, change the password everywhere it was used and turn on two-step sign-in. At work, wait for the security team to confirm the systems are clean.

Learn this in five minutes

The track "Recognise, Contain and Communicate" practises the first hour of a work incident in short lessons: telling what counts as an incident, reporting early, stopping work safely, communicating when systems are down, and responding to ransomware. Five minutes a lesson is enough to make the first move automatic.