The First Hour After a Cyberattack: An Incident Response Plan

Monday, 8:40 a.m. The first employee in the office turns on their computer and sees a red screen: "Your files have been encrypted. Pay in bitcoin within 48 hours." Five minutes later a colleague calls: her computer shows the same thing. Meanwhile, a client writes that they received a strange "invoice" link from your company email. Panic sets in — and it's in exactly these minutes that decisions are made that determine whether the incident costs you a day of work or months of losses.

That's why every company needs an incident response plan for small business — a short, prepared set of steps for moments like this. In this article we walk step by step through the first hour, the next 72 hours, and the period after the incident, and at the end we show you how to write your own one-page plan.

What to do in the first hour after a cyberattack

The first hour isn't for investigating — it's for limiting the damage and preserving evidence. Here's the sequence we recommend.

Step 1: Pause for a minute and write things down

Panic leads to rash actions — restarting, deleting, paying. Take a breath and write down the exact time, who noticed what, and which computers are affected. Photograph the ransom screen with a phone. These notes will be invaluable for your IT specialist, insurer, and the police.

Step 2: Isolate devices, but don't power them off

The goal is to stop the infection from spreading to other computers, the server, or the NAS holding your backups.

• Unplug the network cable and turn off Wi-Fi on affected computers
• If you don't know which ones are affected, disconnect the office from the internet at the router
• Disconnect external drives and USB devices
• Don't cut the power unless your IT specialist tells you otherwise — a running computer's memory may hold traces, and sometimes keys, that help with the investigation and recovery

Step 3: Call your IT specialist

The sooner someone experienced is involved, the less damage there is. That's why the number should be written down on paper — if computers and email are down, your Outlook contacts won't help. Describe what you see and follow their instructions.

Step 4: Don't pay or negotiate in a hurry

Paying doesn't guarantee a working key, that your data won't be published, or that you won't be hit again. Don't reply to the attackers before assessing the situation with a specialist. First you need to find out whether you have a clean backup and whether a free decryptor exists for this particular ransomware — the No More Ransom project collects such tools.

Step 5: Change passwords — from a clean device

If a mailbox is compromised and sending phishing, act fast, but from a computer or phone you're sure isn't affected.

• Change the password on the affected account and sign out all active sessions
• Check whether the attacker added their own phone or authenticator app for MFA
• Check the mailbox rules — attackers often set up external forwarding or rules that hide messages
• Change the passwords for admin accounts and for the systems the affected user can access

Step 6: Preserve evidence and logs

It's tempting to "just reinstall and forget it." But reinstalling destroys the traces showing how the attackers got in and what they took — and without that, you risk being hit again the same way.

• Don't delete the ransom note or suspicious emails
• Export logs from the firewall, the server, and cloud services (for example, the Microsoft 365 audit log, if it was turned on)
• Note which backups are affected and which appear clean

Step 7: Notify the people who need to know

Internally — management and staff, with clear instructions on what to do and not do (for example, don't use the affected mailbox). If phishing was sent from your address, warn clients through another channel — by phone or a different email. If money was transferred to a fraudulent account, call your bank immediately — the faster you act, the better the chance of stopping the payment.

The next 24–72 hours: scope, recovery, and obligations

Once the situation is under control, calmer but equally important work begins.

Determine the scope

Together with your IT specialist, establish which devices, accounts, and data are affected, how long the attacker has been inside, and whether data was exfiltrated. Many modern ransomware attacks copy information first and only then encrypt it.

Clean up and restore from a clean backup

Affected computers are cleaned or reinstalled, and data is restored from backup — after verifying that the backup itself isn't infected. Restore by priority: accounting and the systems the business can't run without come first. This is where well-planned data backup with at least one offline copy really proves its value. If there's no backup, read about the realistic odds of data recovery.

Legal obligations: data protection authority, NIS2, and police

• GDPR: if personal data (of clients, patients, employees) is affected, the controller must notify the supervisory authority — in Bulgaria, the Commission for Personal Data Protection (CPDP) — without undue delay and no later than 72 hours after becoming aware of the breach, unless it's unlikely to result in a risk to people. The CPDP provides a notification form on its website. If the risk to the affected people is high, you must notify them too.
• Cybersecurity Act (NIS2): after the amendments of February 2026, Bulgaria's scope of obligated organizations is much wider. If your company falls within it, separate and shorter deadlines apply — an early warning within 24 hours for a significant incident.
• Police: report to the Cybercrime Directorate of GDBOP, Bulgaria's organized crime directorate (online via cybercrime.bg), or at your nearest police station.
• Insurer: if you have cyber insurance, notify your insurer as early as possible — policies often require it.

The legal judgment on whether and whom to notify is best made with a lawyer or your data protection officer.

After the incident: lessons learned and hardening

Once things work again, gather the people involved and ask honestly: how did the attackers get in, when did we notice, what worked, and what didn't? Then act on the answers:

• Turn on two-factor authentication wherever it's missing
• Update software and close the vulnerability that led to the breach
• Check and test your backups
• Run training — most attacks start with an email, so share our 10 ways to spot a phishing email with your team
• Update the incident response plan with what you learned

How to write a one-page incident response plan

You don't need 50 pages of documentation. For a small business, a single page that anyone can read in two minutes is enough. Here's what it should contain.

Roles

Who declares the incident, who calls IT, who talks to clients and the media, who decides on notifying the data protection authority. Name a deputy for each role — incidents don't wait for someone to get back from vacation.

Contacts — printed on paper

IT support, owner or manager, accountant, lawyer, bank, insurer, internet provider. Print the list and keep it somewhere accessible in the office and at the homes of key people.

A decision tree

Simple "if — then" rules: if a ransom note appears, isolate and call IT; if the mailbox is sending phishing, change the password from a clean device and warn clients; if there's a transfer to an unknown account, call the bank.

Backup restore procedure

Where the backups are, who has access, in what order systems get restored, and how long that takes. If you've never done a test restore, you don't know whether your backup works.

Communication templates

Short, pre-written messages to employees, clients, and the data protection authority. Under stress, it's far easier to fill in a ready template than to write from scratch.

A tabletop exercise

Once a year, gather the team for an hour and walk through a scenario: "Monday morning, the screens demand a ransom — what do we do?" You'll find the gaps in your plan before they cost you money.

Incident response plan for small business: a checklist

• The exact time and what was noticed are recorded; the screen is photographed
• Affected devices are disconnected from the network, but not powered off
• External drives and backups are disconnected
• Your IT specialist has been notified
• No ransom has been paid and there are no hasty negotiations
• Passwords are changed from a clean device and sessions are revoked
• Logs and evidence are preserved
• The bank is notified if a fraudulent transfer is suspected
• Notification to the data protection authority within 72 hours has been assessed
• A report has been filed with GDBOP or the police
• Recovery uses a backup verified as clean
• A lessons-learned review is done and the plan is updated

Frequently Asked Questions

Should I pay the ransom?

Specialists and authorities advise against paying. Payment doesn't guarantee your data will be restored, doesn't stop attackers from publishing stolen information, and funds future attacks. Before any decision, consult an IT specialist and check whether you have a clean backup.

Should I turn off my computer during a cyberattack?

Disconnect it from the network — cable and Wi-Fi — but don't cut the power unless your IT specialist advises otherwise. A running computer holds traces in memory that help the investigation, so isolation stops the spread without destroying evidence.

When do I need to notify the data protection authority?

When the incident affects personal data and is likely to result in a risk to people's rights. The notification must be made without undue delay and no later than 72 hours after you become aware of the breach. If you don't have all the information by then, submit an initial notification and supplement it later.

Where do I report a cyberattack in Bulgaria?

Reports go to the Cybercrime Directorate of GDBOP — online via cybercrime.bg or in person — or to your nearest police station. In the case of fraudulent transfers, also notify your bank immediately.

Prepare the plan before you need it

The best time to write an incident response plan is today, while everything is working. SNM Support helps small and medium businesses in Sofia prepare a plan tailored to their systems, set up backups and protections that make incidents rarer and less painful, and responds when something does happen — as part of our subscription IT support.

In an emergency, call us directly at +359 88 273 6921. To prepare your plan, request a free initial consultation through our contact page.