Company Hacked: What to Do in the First 72 Hours

A hacked company isn't a movie. It's a Monday morning where email won't respond, files have an unknown extension, or an employee reports a wire transfer that should never have been sent. In these moments, most leaders make the same mistake: act fast, but chaotically. They restart servers, delete accounts, erase suspicious files. Each action destroys a piece of the evidence that would help understand what happened. Here's the order to follow in the first 72 hours. It's the same thread we follow in incident response.

The First Hours: Isolate Without Destroying

First instinct: stop the spread, not the investigation.

• Disconnect affected machines from the network (cable or Wi-Fi), but don't turn them off: RAM contains useful traces.
• Change passwords from a clean workstation, starting with administrator accounts and email. Enable multi-factor authentication if it's missing.
• Cut off remote access (VPN, remote desktop, contractor accounts) while you figure things out.
• Do not delete anything: no suspicious files, no unknown accounts, no phishing emails.

Note everything, with the time: what was seen, by whom, what was affected. This log will be useful for analysis, your insurer, and, if necessary, the CNIL.

Preserve Evidence and Notify the Right People

Keep logs (servers, firewalls, email, antivirus), screenshots, and timestamps. Make a copy of healthy backups before any restoration, and verify they haven't been encrypted too.

Then, notify in this order:

• Management and IT department, so one person coordinates;
• The hosting provider and relevant service providers;
• Your cyber insurer, whose policy often imposes a short reporting deadline;
• The CNIL, if personal data is affected: the breach must be notified within 72 hours of becoming aware of it, when it presents a risk to individuals (Article 33 of GDPR);
• Law enforcement, by filing a complaint, often required by the insurer.

Regarding the ransom: don't pay blindly. Each case is different, and paying doesn't guarantee data recovery or the end of the intrusion.

Restore Service Without Reopening the Door, and Your Questions

The classic trap: restoring quickly without having found how the attacker got in. They will then return through the same path. Before restoring service, you must identify the cause (compromised account, exposed vulnerability, infected workstation), clean up any access left by the attacker, and then resume activity in stages, while monitoring.

This is the process our incident response follows: triage, containment, analysis and eradication, restoration. On the dedicated page, we indicate an initial intervention within 72 hours and a callback in less than 5 minutes. Since 2016, over 150 companies have been audited by White Hat (figures from the page My Company Was Hacked, reviewed on 11/04/2026). Once the emergency is over, a security audit verifies that the vulnerability is closed and no others are lurking: see IT Security Audit.

Should I turn off hacked machines?

No, unless instructed otherwise by an expert. Disconnect them from the network and keep them powered on to preserve memory.

Do I need to notify the CNIL?

If personal data of clients, employees, or prospects is affected, yes, within 72 hours of discovery when the breach poses a risk to individuals.

Can I restore my backup right away?

Not before understanding the intrusion. First, check that the backup is clean, otherwise you'll reinstall the problem.

When should I get an audit after the incident?

As soon as activity has resumed. It confirms that the cause has been corrected and looks for other exploitable vulnerabilities.

In the first 72 hours, three rules: isolate without destroying, note everything, do not restore anything before understanding. The rest (CNIL, insurer, complaint) follows in this order.

If your company is affected right now, an expert will call you back from the emergency page, with no online payment and no commitment.