We have been hacked: what to do in the first 24 hours

By Kike Gandia · Co-Founder & CEO, OSCP

If you are reading this with an incident in progress: do not switch off the affected machines, disconnect them from the network, do not delete or reinstall anything, and write down the time of everything you do. Then follow this guide in order. It is written for companies operating in Spain, not individuals, and it separates what to do in the first hour, what to do in the first day and who to notify, with their legal deadlines. For free help right away, INCIBE's 017 helpline serves both companies and citizens.

First hour: contain without destroying evidence

Isolate, do not power off. Disconnect the affected machines from the network (cable and Wi-Fi), but leave them on: memory holds evidence that is lost when you shut down. If the attack is spreading, isolate the whole network segment.
Do not delete, reinstall or restore yet. Restoring onto a compromised system reinfects it, and deleting destroys what you need to know how they got in.
Cut remote access that is not essential: VPN, remote desktop, supplier access.
Change critical credentials from a clean device: domain administrators, email, cloud, banking. Turn on multi-factor authentication wherever it is missing.
Open an incident log: time, who detected it, what is seen, what is done and who decides. You will need it for notifications and for the insurer.
Bring in the decision-makers: management, the technical lead and, if you have one, the external security team. One person coordinates; nobody acts on their own.

First 24 hours: understand the scope

Work out what is affected: which systems, which accounts and, above all, whether personal or customer data is involved. Notifications depend on it.
Preserve evidence: logs from servers, firewall, email and cloud; memory and disk images of key machines if possible. Cloud and email logs often expire after a few days.
Tell your insurer if you have cyber insurance: many policies require prompt notice and have approved incident-response providers.
Check your backups before using them: make sure they are out of the attacker's reach and have not been encrypted or tampered with.
If it is ransomware, do not pay without advice: paying does not guarantee you get the data back or that it will not be published, and it can have legal implications.
Prepare communications: to staff (what not to do), to customers if they are affected and to the relevant authorities, with consistent messages.

Who to notify and when (Spain)

Situation	Who	Deadline
Personal data breach posing a risk to individuals	Spanish Data Protection Agency, AEPD (GDPR, art. 33)	72 hours from becoming aware
Breach posing a high risk to those affected	The affected individuals (GDPR, art. 34)	Without undue delay
Any company: help and technical guidance	INCIBE: 017 helpline (8:00 to 23:00, every day) and, for incidents, INCIBE-CERT at incidencias@incibe-cert.es	As soon as you can
Crime (extortion, fraud, data theft)	Report to the Policía Nacional or the Guardia Civil	As soon as possible, before the trail goes cold
Financial entity: major ICT-related incident	Its supervisory authority (DORA)	Initial notification within 4 hours of classifying it as major, and no later than 24 hours after detection
Manufacturer: actively exploited vulnerability or severe incident in its product	ENISA single reporting platform (Cyber Resilience Act, art. 14)	Early warning within 24 hours
Operator of essential services or digital provider (NIS1 regime)	Its reference CSIRT (INCIBE-CERT or CCN-CERT)	Without delay
Public sector	CCN-CERT	Without delay

If you notify on time with what you know and add details later, you comply: the GDPR allows notification in phases (art. 33.4). What makes things worse is staying silent, delaying or playing it down.

A practical detail: notification to the AEPD is made through its electronic office and requires an electronic certificate. Have it located before you need it; the 72 hours also run over weekends.

What not to do

Switch off or reinstall machines before collecting evidence.
Use the compromised company email or chat to coordinate the response: the attacker may be reading it.
Negotiate with the attacker on your own.
Restore backups without checking them.
Tell customers, staff and authorities different stories.
Close the incident without knowing how they got in: if the door is not shut, they come back.

Afterwards: make sure it does not happen again

Once the incident is closed, find and fix the root cause: it is almost always a combination of a few lapses, such as an account without multi-factor authentication, an unpatched machine, a backup that was never tested or alerts nobody was watching. A follow-up penetration test checks that the door is really shut, and managed security puts someone on the alerts so the next attempt is detected in time. To see how those lapses chain together, try our [breach simulator](/en/blog/how-a-company-falls-simulator/).

FAQ

Should I turn off the computer if I think I have been hacked?

No. Disconnect it from the network (cable and Wi-Fi) but leave it on: memory contains evidence that is lost when you switch off and that helps establish how the attacker got in and what they did.

Do I have to notify the AEPD if we are hacked?

If there is a personal data breach that poses a risk to individuals, yes: within 72 hours of becoming aware (GDPR, art. 33). You can notify with what you know and add details later. If the risk to those affected is high, you must also tell them.

Where can I get free help in Spain?

INCIBE serves companies and citizens on the 017 helpline, free and confidential, and its INCIBE-CERT team provides technical support for incidents. To report a crime, contact the Policía Nacional or the Guardia Civil.

Should we pay a ransomware demand?

The general advice from the authorities is not to pay: it does not guarantee you get the data back or that it will not be published, it funds new attacks and it can have legal implications. Before deciding anything, get technical and legal advice.

Can we restore backups straight away?

Only after checking that the backups are not compromised and after closing the attacker's way in. Restoring onto systems that are still compromised, or from tampered backups, usually ends in a second infection.

How do we find out how they got in?

From system, email, cloud and firewall logs, and from analysis of the affected machines. That is why it matters so much not to delete or reinstall anything in the first hours: without that evidence, the root cause stays a guess.

Sources

Talk to our team