Emergency · Attack
Hit by a cyber attack – what do you do first?
The first hours decide how much you lose, how quickly you are back and whether you can show what happened. The most important advice is also the hardest: act calmly and delete nothing.
Urgent Book a meeting or email us – we normally reply within one working day.
Is the attack happening now? Get in touch. Disconnect the affected network from the internet, but don't switch off or reformat anything before someone has secured logs and evidence.
The first 24 hours
Hour by hour
-
0–1 hour – isolate and raise the alarm
Disconnect affected systems from the network. Turn off wireless, pull out network cables, but leave the computers switched on – memory may hold the only trace of the attacker. Alert management and your IT partner. Change passwords on accounts that can be reached from outside, starting with email and administrator accounts.
-
1–4 hours – understand the scope
Which systems are affected, which accounts have been hijacked, is there data that may have been copied? Look for signs that the attacker is still inside – new accounts, scheduled jobs, email forwarding. Appoint one person to hold everything together and keep a log of every decision.
-
4–24 hours – report and secure
Report it to the police. If personal data may have been disclosed: do the risk assessment and prepare the notification to IMY within 72 hours. Contact the bank if payments may have been affected, and your insurer if you have cyber insurance. Decide who may speak publicly.
-
1–3 days – restore in a controlled way
Verify that the backups are intact and free of the attacker before you restore. Rebuild in a clean environment, restore only data, and close the way in – otherwise you will be back in the same situation within a few weeks.
-
Weeks 1–4 – clean up and explain
A review of all accounts and permissions, mandatory two-factor authentication, updated systems, a new incident procedure. And communication: customers, suppliers and staff need to know what happened – without speculation.
The ransom
Should we pay?
No. The advice from Swedish and international authorities is unanimous, and the reasons are practical, not just principled:
- There is no guarantee. A large share of those who pay still don't get their data back – or are targeted again, because paying shows that you pay.
- It funds crime and makes the next attack possible, often against someone in your own industry.
- It may be illegal. Paying someone who is under sanctions can amount to a breach of sanctions – a matter for your lawyer, not for the IT department.
- Recovery is usually possible. If you have backups that work, the way back is a matter of hours or days, not of money.
And the threat is not always encryption. Increasingly, the attacker only steals data and demands money not to publish it. The same applies then: report, document, inform – and expect that the data may become public.
The notifications
Who needs to be informed – and when?
| Recipient | When | Why |
|---|---|---|
| The Swedish Police | Immediately | Computer intrusion and extortion are crimes. A report is also needed for the insurance. |
| IMY | Within 72 hours | If personal data has been disclosed or is at risk of having been disclosed. |
| CSIRT / sector authority | Early warning within 24 hours | If you are covered by the Swedish Cybersecurity Act. See NIS2 incidents. |
| Bank and card acquirer | Same day | In case of attempted fraud, hijacked payments or suspected card misuse. |
| The insurer | As per the policy, often within 24 hours | Compensation, and requirements on which consultants may be engaged. |
| Customers and partners | As per contract | Contractual requirements, but also trust. Facts beat silence. |
| The data subjects | Without undue delay | Where there is a high risk to their rights and freedoms. |
Six mistakes we see most often
- Starting from scratch in a panic. Formatted disks and restored systems remove both the attacker and the evidence – and make it impossible to know what was stolen.
- Thinking it's over once the systems work. Attackers often leave a way back in. Without a review of accounts, permissions and scheduled jobs, you are vulnerable again.
- Restoring a backup that already contains the attacker. Backups need to be verified, not just exist.
- Replying to the attacker yourselves. Negotiation takes experience. If you do it, do it with help from someone who has done it before – and never without knowing what you are legally allowed to do.
- Keeping customers in the dark. What damages trust most is not the attack, but customers hearing about it from someone else.
- Not changing what leaked. If passwords or customer data are in the stolen material, they must be treated as disclosed, whatever the attacker claims.
Questions and answers
What we get asked
Should we switch off the computers?
Disconnect them from the network, but leave them switched on if you can. Volatile memory and logs can be crucial evidence.
Do we have to report it to the police?
Computer intrusion and extortion are crimes and should be reported. Your insurer also often requires a report before it will pay out.
How do we know whether data has been stolen?
Often it cannot be determined with certainty. You then base the risk assessment on the worst reasonable scenario and inform accordingly – which is also what a review expects.
How long does recovery take?
With working, verified backups: from a few hours to a few days. Without them it can be a matter of weeks. That is the single most important factor.
Can you help us in the middle of an ongoing attack?
Yes. We start by securing evidence and stopping the spread, then deal with notification, information and recovery in the right order.
What does an attack cost?
Downtime, recovery work, lost customers, a possible administrative fine and damaged trust. For most small and medium-sized companies the downtime is the largest item – not the ransom.
Sources and further reading
- NCSC – in-depth guidance on extortion attacks
- The Swedish Police – report a computer intrusion
- CISA – Ransomware Response Checklist
Information from authorities changes. Always check the current rules and deadlines with the responsible authority, and take legal advice for legal assessments.
More urgent situations
Other situations we step into
Urgent
We can be in your systems today
Get in touch and describe the situation. We help you secure evidence, stop the spread and take the questions in the right order – notification, information and recovery.
Urgent Book a meeting or email us – we normally reply within one working day.