Imagine starting your workday with three discoveries: your files will not open, customers are receiving fraudulent invoices from your email address, and a payment has reached the wrong bank account.
This is an illustrative scenario, not a reported incident. But each part represents a real category of cyber risk: ransomware, account takeover, and payment fraud. When they overlap, the challenge is not simply removing malicious software. It is protecting money, restoring operations, preserving evidence, and maintaining trust.
Your worst cybersecurity nightmare is discovering that an attack has happened—and nobody knows what to do next. The practical defense is a combination of preventive controls, tested recovery capabilities, and clear decisions made before an emergency.
Know Which Emergency You Are Facing
“We have been hacked” is a starting point, not a diagnosis. Different incidents demand different first actions:
- Account takeover: Someone controls your email, social media, or business account. Recover access and remove unauthorized access paths.
- Payment fraud: Money has been redirected through deceptive instructions. Contact the bank immediately.
- Ransomware: Systems or files are inaccessible, often alongside threats involving stolen data. Isolate affected systems and activate incident response.
- Data exposure: Sensitive information may have been accessed or stolen. Contain the exposure, investigate, and assess notification requirements.
These categories can overlap. Restoring encrypted files, for example, does not resolve the separate problem of stolen information.
If an Attack Is Happening Now
Compromised account: Secure more than the password
Use a trusted device and the provider’s official recovery process, rather than a link in an unexpected message. For a workplace account, notify IT immediately; administrators may need to disable the account while investigating.
Once access is restored:
- Set a strong, unique password and change any reused passwords elsewhere.
- Use available controls to sign out other sessions.
- Enable multifactor authentication and check for unfamiliar authentication methods.
- Verify recovery phone numbers and email addresses.
- Remove suspicious forwarding rules and review sent and deleted messages.
- Warn contacts if the account sent fraudulent requests.
The FTC’s account-recovery guidance explains these consumer steps. For businesses, Microsoft’s compromised-account guidance also covers session revocation, application permissions, authentication registrations, and hidden mailbox rules. Those are administrator tasks: a password reset alone is not a complete investigation.
Fraudulent payment: Call the bank first
Contact your financial institution through a known, trusted number. Explain that the transfer may be fraudulent and request an immediate recall or reversal. Ask the institution to contact the receiving bank.
Do not wait for your internal investigation to finish. Preserve payment details, messages, account numbers, and timestamps. The FBI’s business email compromise guidance also recommends reporting the incident to the Internet Crime Complaint Center, or IC3. Recovery is not guaranteed, but prompt action matters.
Ransomware: Isolate affected systems
Disconnect affected devices from the network, including Ethernet and Wi-Fi, and contact your response team. A widespread incident may require coordinated network-level containment.
Disconnecting is not the same as powering off. The CISA #StopRansomware Guide advises powering down affected devices when network disconnection is not possible, because shutdown destroys evidence held in memory. Use a separate, trusted communication channel if normal email or messaging may be compromised.
Do not reconnect systems or begin wiping devices simply because doing so seems faster. Containment, evidence collection, and restoration need coordination.
Exposed data: Contain, investigate, and involve the right people
For a business, engage qualified technical responders and appropriate legal support. Preserve relevant logs, document decisions, and determine what information was affected and whose information it was.
Notification duties depend on the circumstances and applicable law. The FTC’s business breach-response guide recommends assembling a response team, securing operations, addressing vulnerabilities, and communicating appropriately. Avoid declaring that “no data was stolen” before the evidence supports that conclusion.
Reduce the Chances—and the Consequences—of an Attack
1. Protect the accounts that control everything else
Prioritize email, banking, administrator accounts, and services containing essential information. Email deserves particular attention because it often receives password-reset messages for other accounts.
Enable MFA wherever available, preferably phishing-resistant methods such as supported FIDO/WebAuthn security keys or platform authenticators. NIST explains that one-time codes and SMS authentication can still be susceptible to phishing.
Use unique passwords and a password manager where appropriate. Test account recovery before enforcing new authentication requirements: losing a phone should not leave the business without a safe way to regain access.
2. Treat backups as a recovery capability
A successful backup notification does not prove that operations can resume. Protect backups from attackers, isolate them appropriately, and test restoration.
NIST’s ransomware preparation guidance emphasizes isolated backups and recovery testing. Include the applications, configurations, and dependencies needed to use recovered information—not just the documents themselves.
For example, restoring invoice files is insufficient if nobody can access the accounting application. Decide how much recent work you can lose and how long each critical service can remain unavailable. Offline or carefully configured immutable backups can improve resilience, but storage costs, retention requirements, and restoration speed still matter.
3. Assign ownership for updates and access
Keep an inventory of devices and important software. Assign responsibility for updates and endpoint protection, and confirm that maintenance actually happens. For critical systems, testing and rollback plans should enable timely patching—not justify indefinite delay.
Apply least privilege: people and services should receive only the access their tasks require. Use ordinary user accounts for routine work, and remove unnecessary access when roles or providers change. These practices align with NIST’s cybersecurity basics.
4. Verify payment changes independently
If a supplier emails new bank details, call a previously known contact number before changing the payment destination. Do not use the number supplied in the suspicious message.
A realistic example: an invoice looks legitimate, the sender’s account is familiar, and the request sounds urgent. None of those details establishes that the new bank account is authorized. Independent verification breaks the fraud pathway.
For higher-risk payments, consider a second approver. Verification adds friction, so define the process and escalation route in advance. Urgency should not become permission to bypass it.
5. Prepare a response plan that works without email
NIST’s incident-response recommendations integrate preparation, detection, response, and recovery into ongoing cybersecurity risk management.
Start with a short plan naming the incident lead, who can disable accounts or isolate systems, recovery priorities, and contacts for the bank, responders, counsel, and insurer where applicable. Keep a copy accessible outside potentially compromised systems.
Rehearse a simple scenario: email is unavailable, a computer displays a ransom note, and a customer reports a suspicious invoice. Unclear decisions identified during an exercise are much cheaper to fix than during an attack.
Recovery Is More Than Getting Files Back
The FBI does not support paying ransomware demands. Payment does not guarantee recovery and encourages criminal activity. Involve qualified responders and legal counsel rather than treating payment as a shortcut around containment and investigation.
Before restoring normal operations, address the identified entry point, review account access, validate restored systems and data, and monitor for continuing compromise. NIST’s data-integrity recovery guidance emphasizes trustworthy recovery supported by monitoring and audit information.
Recovery means restoring trustworthy operations—not simply making the warning message disappear.
Communicate confirmed facts, explain what remains unknown, and give affected people practical protective steps. Reassurance should follow evidence, not replace it.
Your Cybersecurity Readiness Checklist
Use this checklist to identify gaps, not as a certification of security:
- Important accounts have MFA, preferably phishing-resistant.
- Passwords are unique, and recovery details are current.
- Updates and endpoint protection have an assigned owner.
- Unnecessary user, administrator, and provider access is removed.
- Critical data has protected backups, with a successful restoration test.
- Payment-detail changes require independent verification.
- Response contacts and instructions are available without normal email.
- Someone has authority to contain systems and contact the bank.
- The response plan has been rehearsed.
- Evidence preservation, legal review, and communications are covered.
Make the Next Step Concrete
No security program can promise that an attack will never happen. A prepared individual or business can, however, avoid turning an incident into an uncontrolled crisis.
Choose one unchecked item today, assign an owner, and set a completion date. Then verify that it works. Preparation becomes valuable when it changes what you can actually do under pressure.