My Business Has Been Hacked? What To Do Right Now.
If you're dealing with a live cyber attack, follow the steps below in order. Holker IT's Cyber Attack Response team can start containment within minutes of your call.
Get In Touch
Fill out the form and a member of our Cyber Attack Response team will be in touch. No hard sales, just honest advice.
- Rapid Response
- Containment Within Minutes
- UK-Based Response Team
- No Existing Contract Needed
Do This Before Anything Else.
What you do in the first few minutes can make the difference between a contained incident and a much bigger problem.
- 1Don't panic, and don't shut down the affected computer.Disconnect it from the network instead (unplug the cable or turn off Wi-Fi) rather than powering it off.
- 2Isolate, don't investigate.Stop the infection spreading, but leave devices on and avoid poking around yourself, it can destroy evidence.
- 3Contact your IT support or security provider immediately.The sooner a specialist is involved, the faster containment can start.
- 4Don't pay anyone yet.If there's a ransom demand, don't engage or pay until you've taken proper advice.
- 5Alert a colleague.Don't handle a live incident alone, get someone else in the loop straight away.
Your Containment Checklist.
Once the immediate response is underway, work through these steps to limit the damage.
- Isolate affected systems from the rest of your network.
- Disable compromised accounts and enable MFA wherever it isn't already on.
- Preserve evidence. Don't wipe or reinstall anything yet, it may be needed for investigation or a claim.
- Verify the integrity of backups that predate the attack.
- Notify leadership within the hour, don't let this sit with one person.
- Engage specialist incident response help if you haven't already.
What Kind of Incident Are You Dealing With?
Different incidents need different first steps. Here's how to recognise what's happening.
Ransomware
Files renamed or won't open, ransom notes appearing, or servers failing to boot properly.
Business Email Compromise
Unusual items in your Sent folder, redirected invoices, or unfamiliar login alerts.
Data Breach
Unexplained data transfers, customer notifications, or alerts from a vendor about their own breach.
Supply-Chain Breach
A third-party vendor with access to your systems has been compromised.
Source: gov.uk Cyber Security Breaches Survey 2025/2026
Common Mistakes in the First 24 Hours.
These are the mistakes we see most often, and each one makes recovery harder or more expensive.
- Paying a ransom immediately, without advice.
- Wiping systems before evidence has been captured.
- Restoring from backup before the entry point is closed.
- Going public before the facts are confirmed.
- Ignoring your cyber insurance policy's requirements.
- Underestimating the scope of the incident.
What Our Cyber Attack Response Team Does.
Whatever your current IT setup, whether that's another provider or nothing in place, we'll talk through the best way we can help.
Containment & Eradication
Isolating affected systems and removing the threat so it can't spread further.
Evidence Preservation
Securing logs and technical evidence for investigation and any insurance claim.
Standby Infrastructure
Cloud-based server copies that can help keep your business running while systems are restored.
Ongoing Support
Continued support from our Cyber Attack Response team for the duration of the incident, from first call through to resolution.
Make Sure It Doesn't Happen Again.
Once the immediate incident is under control, we help you close the gaps that let it happen in the first place.
- Penetration testing to identify exploitable gaps before someone else finds them.
- Cyber Essentials certification, the government-backed baseline for good security practice.
Frequently Asked Questions.
How quickly can you respond?
Our Cyber Attack Response team can begin containment work within minutes of your call during business hours, and we do our best to help with genuinely critical incidents outside of those hours too.
Do we need to already be a Holker IT client?
No. Whatever your current IT setup, whether that's another provider or nothing in place, we'll talk through the best way we can help.
Do we need cyber insurance to get help?
No. If you have cyber insurance, we can work alongside your insurer's requirements, but you can still engage our Cyber Attack Response team directly if you don't have a policy in place.
What should we do before you arrive or call back?
Follow the first 5 minutes guidance above: isolate affected devices without shutting them down, avoid investigating yourself, and don't pay any ransom demand until you've had advice.
Can you help prevent this from happening again?
Yes. Once the immediate incident is resolved, we can carry out penetration testing and support you towards Cyber Essentials certification to close the gaps that led to the incident.
Dealing With an Attack Right Now?
Don't wait. Our Cyber Attack Response team can start containment within minutes of your call.