The First Hour After a Suspected Breach SOP

Purpose

When someone in the shop suspects an account or computer has been taken over (a password typed into a fake page, a strange login alert, a payment nobody recognizes, a screen demanding payment), the first hour decides three things: whether the attacker keeps access, whether money still in motion can be stopped, and whether the shop keeps the evidence its bank and insurer will ask for. Without a written order, people do the natural things in the wrong sequence: they reboot the computer, delete the scary email, change the password from the infected machine, and discuss it all by email while the attacker reads along. This procedure fixes the order. It owns incident response for the library's security cards; the others point here.

Scope

Covers the first 60 minutes after any credible sign of compromise of a shop account (email, bank, card processor, domain, business profile, software) or a shop device, whether or not money has moved. Run it on suspicion; a false alarm costs an hour, a late start costs the money.

It does not cover what comes after the hour: legal notification to affected people (Handling a Data Breach Notification Obligation), rebuilding a locked computer (Ransomware Locked the Office Computer), a lost device with no sign of misuse (The Lost or Stolen Field Device SOP), or recovering a hijacked listing or social account, which have their own cards.

Roles and responsibilities

Procedure

Step 1. Declare the incident and start the log. The person who noticed tells the incident lead by phone or in person, not by email or chat on a shop account, because the attacker may be reading both. The lead writes the time on a paper log or a note on a personal phone and names the affected user, account and device. Acceptance: a log with a start time and the lead's name, written within 5 minutes of the first report. Wrong looks like a group email thread about the problem; stop rule: move it to phone at once and note in the log that the thread exists. Hazard: none physical; the exposure is announcing your response on the channel the attacker holds.

Step 2. Disconnect the affected device, do not turn it off. Unplug its network cable and switch off Wi-Fi; on a phone, turn on airplane mode. Leave it powered and do not restart, run a cleanup tool, or reinstall anything. Acceptance: the device shows no network connection and is still on, with its screen as it was. Wrong looks like a demand-for-payment screen, or files renaming themselves; stop rule: photograph the screen, disconnect every other computer on that network the same way, do not contact the attacker or pay anything, and go to Ransomware Locked the Office Computer after finishing steps 4 to 6. Hazard: powering off destroys the record of what is running in memory, and a restart can let some malicious software finish its work.

Step 3. Preserve what you can see. Photograph the screen and any alert. Keep the suspicious email: do not delete it, and if it must be sent to someone, forward it as an attachment. Have the affected user write in the log, in their own words, what they clicked, what they typed and at what time. Acceptance: photos with visible timestamps, the original message still in the mailbox, and a written account from the user. Wrong looks like an emptied trash folder or a user who says "I'm not sure"; stop rule: do not reconstruct from memory later, write "not known" now. Hazard: blaming the user at this step makes them minimize what happened, and the detail they leave out is usually the one that matters.

Step 4. Change credentials from a clean device, email first. Use a device that did not touch the incident, ideally a phone on cellular data. Change the affected account's password first, then email if it is not the same account, since email resets everything else, then the bank, the card processor, the domain registrar and the password manager. In each: sign out all other sessions, check forwarding and filter rules, check the recovery email and phone, and turn on multifactor. Acceptance: every account on the shop's inventory that the affected user could reach is marked changed with a time, sessions revoked, recovery details confirmed as the shop's own, and no unknown rules. Wrong looks like a recovery phone you do not recognize or a lockout; stop rule: stop guessing passwords, use the provider's account recovery or the admin console of your business email, and log each attempt. Hazard: changing a password on the compromised machine hands the new one to whatever captured the old one. See related: The Account Inventory Every Shop Should Keep.

Step 5. Call the bank's fraud line. Call whenever money, a payment system, or the email of anyone who approves payments is involved, which in a small shop is almost always. Ask the bank to review payees and payments from the last 30 days, hold new outgoing payments pending your callback, and recall any payment you do not recognize. Acceptance: a case number, the agent's name and the time in the log. Wrong looks like a payment that left in the last 72 hours; stop rule: file a complaint at ic3.gov within the hour as well, with the payment details and the bank's case number. Hazard: an inbound call "from the bank" during an incident is a known follow-up attack; only the number on the back of your card or statement counts.

Step 6. Notify the insurer before hiring anyone. Call the incident hotline on the cyber or crime policy, or the agent if you cannot find one. Many policies want you to use their approved responders and may decline costs from vendors you chose yourself. Acceptance: an incident or claim number and written instructions on who to call next. Wrong looks like no cyber coverage at all; stop rule: call the agent anyway, and if customer or employee personal information may be involved, call a business attorney before the end of the day. Hazard: late notice is a separate ground for denial, so notice goes today even when you think nothing is covered.

Step 7. Scope it at minute 60. The lead writes down what the attacker could have reached: which mailboxes, what was in them (customer addresses, gate and alarm codes, employee tax forms, card details), and whether any money moved. Acceptance: a written list of exposed data types with "known" or "possible" beside each, and a named person picking up the next stage. Wrong looks like customer or employee personal data on the list; stop rule: do not notify customers or post anything publicly until the attorney or the insurer's responder says how, because notification is governed by state law and the wording matters. See related: Handling a Data Breach Notification Obligation. Hazard: wiping and rebuilding to "get back to work" before scoping destroys the evidence step 7 depends on.

The record this produces

The incident log, on paper or a personal device until the shop's systems are trusted again: start time, lead, affected user and account, each action with its time, every outside call with the case number and the name of the person, the photos, the user's own account, and the exposure list from step 7. The insurer's responder reads it first, the bank reads the payment section, the attorney reads the exposure list, and the owner reads the whole thing at the annual security review to decide which control would have prevented it.

When the hour does not go to plan

The attacker is still active, moving mail or changing settings while you watch. Speed matters more than order: do step 4 for the email account immediately, then come back to steps 2 and 3.

Nobody can reach the owner. The office manager is lead; the bank and insurer calls do not wait.

It is a false alarm. A login alert from a tech on a new phone. Still finish steps 1 and 7, write "false alarm, cause" in the log, and keep it; a log of false alarms is how you learn which alerts are noise.

Worked pass: a password typed into a fake login page

A sixteen-person plumbing shop, a Thursday.

• Step 1. 9:14 a.m.: the office manager tells the owner in person that she clicked a "shared document" link at 9:05 and typed her email password. Log started 9:16 on a paper pad, owner as lead. Pass, 2 minutes.
• Step 2. 9:18: her desktop's network cable pulled, Wi-Fi confirmed off, machine left on. Pass.
• Step 3. 9:21: the email kept, screen photographed, her account written down: link clicked 9:05, password typed, a second page asked for a code from her phone and she entered it at 9:06. Pass. That last detail means multifactor was bypassed, not absent.
• Step 4. 9:27, owner's phone on cellular. Her email password reset from the business email admin console, all sessions signed out. Mailbox rules: a new rule created at 9:11 moving any mail containing "payment" to an archive folder. Deleted. Recovery phone: changed at 9:12 to a number nobody recognizes. Fail. Stop rule applied: no guessing; the admin console restores the shop's own number and the change is logged with its time. Bank, processor and registrar passwords she held were changed next, finishing 9:49.
• Step 5. 9:52: bank fraud line. No new payees, no unrecognised payments in 30 days. Case number logged; outgoing payments held until the owner calls back. Pass.
• Step 6. 10:01: cyber policy hotline. Incident number issued; told to use the insurer's responder and not to wipe the machine. Pass.
• Step 7. 10:12: exposure list: her mailbox, holding customer addresses, some gate codes in job notes, and two employees' tax forms she had emailed to the bookkeeper. Personal data marked "possible." Attorney called at 10:20 per the stop rule. The handoff to the insurer's responder happened at minute 66, past the 60-minute line by six minutes, and the log says so.

Re-read against the general section: step 4's failure is the reason the procedure demands checking recovery details and not just passwords. An attacker who has changed the recovery phone can take the account back an hour after you reset it.

References

• See related: The Account Inventory Every Shop Should Keep
• See related: Handling a Data Breach Notification Obligation
• See related: Ransomware Locked the Office Computer
• See related: The Office Paid a Fake Supplier Invoice
• FBI Internet Crime Complaint Center (ic3.gov), and CISA guidance on incident response for small organizations