The summary.
THE FIRST HOUR
Contain: disconnect affected devices.
Establish scope. Change credentials, from a clean device. Stop ongoing harm — contact your bank immediately if money is moving. Record everything, with times.
WHY TIMES MATTER
Notification obligations frequently run from when you became aware.
THE MISTAKE THAT UNDOES RECOVERY
Restoring before closing the entry point. The compromise simply returns.
THE STEP MOST PEOPLE SKIP
Ending existing sessions and revoking application access. Changing a password does not always do it.
And checking for scheduled tasks, which are used to restore access after a cleanup.
BEFORE RESTORING A BACKUP
Establish when the compromise started. A recent backup may already contain it.
ON TELLING PEOPLE
Tell them early and factually. Warn them that stolen information is used to impersonate you convincingly.
Discovery later is far worse than disclosure now.
WHAT TO PREPARE NOW
A short plan, kept somewhere reachable when your systems are not, with a draft customer message already written.
AFTERWARDS
Fix the cause, not the person. A system that depends on nobody making a mistake is the actual failure.
