Learn how a simple outage plan helps your small business keep working, contact customers, and respond when Microsoft 365 or other cloud tools go down.”
Learn when to use OneDrive, SharePoint, and Teams so business files stay easy to find, simple to share, safe when staff leave, and easier to recover too
Old WordPress plugins can expose your business website to malware, spam, and data theft. Learn how updates, backups, and clear ownership reduce the risk.
Scam search ads can steal logins or install malware. Learn how sponsored results mimic trusted brands and how your team can avoid these dangerous links.
AI phishing emails now look polished and personal. Learn which warning signs still work and how to verify requests for money, logins, and bank changes.
The first hour after a cyberattack matters. Quick action can limit the damage, protect your backups, and give investigators a better chance of finding out what happened. It is also an easy time to make a costly mistake. You might turn off the wrong computer, delete useful evidence, or send an email through an account the attacker can still read. You do not need deep technical knowledge to take the first steps. You need a clear order of action and the right phone numbers. This guide explains what to do during the first hour. It also covers where to report an attack in the United States, United Kingdom, and Australia. What Not to Do After a Cyberattack Pause before you start trying to fix the problem. A rushed action may destroy evidence or warn the attacker that you have found them. Do Not Turn Off the Affected Computer Disconnect the computer from the network instead, if you can. Unplug its network cable and turn off its Wi-Fi. Turning off a computer can remove evidence stored in its memory. That evidence may help your IT provider or an investigator learn how the attack happened. CISA advises businesses to isolate affected devices when possible. Shut down a device only when you cannot disconnect it from the network in another way. Do Not Delete or Clean Up Anything Leave ransom notes, strange emails, alerts, and unusual files where they are. Do not delete them or move them to the trash. Do not wipe the computer or reinstall its software. Your IT or incident response team may need the original evidence. You can take screenshots of what you see. Keep the original message or alert in place as well. Do Not Pay a Ransom Right Away A ransom note often creates fear and urgency.