What should you do in the first hours of a cyberattack?

In the first hours of a cyberattack, the aim is to contain without destroying: disconnect affected machines from the network without switching them off, alert your MSP and the incident response team, take backups offline, open an incident log and convene a crisis unit. These steps limit the spread while preserving the evidence the investigation will need.

These first hours are only the beginning. For the full sequence, see our guide How does incident response work?.

The first minutes: contain and raise the alarm

The ransomware guidance from cybermalveillance.gouv.fr, the French government’s cyber assistance service, is a sound baseline for most attacks:

1. Disconnect infected machines from the network: unplug the network cable, turn off Wi-Fi. If the attack is widespread, cut the affected network’s internet access.
2. Do not switch affected machines off: powering down wipes memory, which holds traces the investigation needs. If encryption is still running, hibernation may be considered.
3. Do not power on machines that were off and may have been spared.
4. Disconnect backups still attached to the network, to protect them.
5. Alert your MSP or IT team immediately.

With an EDR in place, network isolation can be triggered remotely from its console in seconds, without powering the machine down.

The first hour: mobilise

• Engage the incident response team. When an incident response contract is already in place, the contacts and terms are known in advance. Without one, you first have to find a provider and agree terms, which costs time. See Can you call in an incident response provider without a contract?.
• Convene a crisis unit: a decision-maker from management, the MSP or IT lead, and legal and communications where needed.
• Open an incident log: every finding and every action, timestamped. It will feed the investigation, the insurer and regulatory reports.
• Switch to a secure channel if email or the directory may be compromised.

See Who is on an incident response team?.

The following hours: triage and contain

The response team builds a first picture of the situation:

Question	Why it matters
Which machines and accounts are affected?	To target containment
Is the attacker still active?	To decide how fast and how widely to cut off
Are privileged accounts compromised?	A compromised admin account changes the whole strategy
Could data have left the network?	To anticipate any notifications provided for by the GDPR
Are the backups intact?	To estimate recovery

Containment widens according to the answers: disabling accounts, blocking outbound traffic, isolating network segments, cutting remote access. Volatile evidence is collected in parallel before it disappears. See How do you contain a system without destroying evidence?.

Within the first 24 hours: next steps

• Police report: in France, cybermalveillance.gouv.fr recommends filing a complaint alongside the technical response, before reinstalling equipment.
• Insurer: inform them early. Each cyber insurance policy sets its own conditions (deadlines, supporting documents): check them in the policy itself, with the insurer or broker.
• NIS2: Article 23 of the directive provides, for entities in scope, for an early warning to the competent authority or CSIRT within 24 hours of becoming aware of a significant incident. France had not yet adopted its transposition law as of 25 September 2026.
• GDPR: Article 33 provides, for personal data breaches and under the conditions it sets out, for notification to the supervisory authority (the CNIL in France) within 72 hours.

Whether these texts apply to a given situation is a legal question: the organisation’s legal counsel is the right person to ask.

See Is incident response mandatory?.

What to avoid

• Reinstalling or restoring too soon: it wipes evidence and risks bringing back a system that is still compromised. See When can you restart production after an attack?.
• Paying the ransom: cybermalveillance.gouv.fr advises against it.
• Acting alone without coordinating with the response team.
• Communicating in the heat of the moment without an approved message.

How Cyna steps in during these first hours

Cyna’s managed SOC, operated 24/7 from France, detects and triages alerts; with SentinelOne or Microsoft Defender, it can isolate an endpoint remotely. Cyna’s CERT, a member of InterCERT France, works with the SOC teams and can be mobilised quickly. Cyna’s incident response on-call team is available 24/7 from the Report an incident page. The partner MSP remains its client’s point of contact.

Talk to an expert

Want to prepare a first-response checklist for your organisation or your clients? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Should affected computers be switched off?

Generally not. cybermalveillance.gouv.fr, the French government's cyber assistance service, advises disconnecting them from the network without powering down, because shutting down wipes memory that the investigation needs. If encryption is still running, hibernation may be considered. See How do you contain a system without destroying evidence?.

Should you pay the ransom to speed things up?

cybermalveillance.gouv.fr advises against paying: there is no guarantee you will get your data back, and payment does not prevent another attack.

Can customers be told straight away?

Yes, but with a prepared message, approved by the crisis unit, that sticks to established facts. Improvised communication tends to create more problems than it solves.

Whom do you call if you have no provider?

Your MSP first. In France, 17cyber.gouv.fr, run by cybermalveillance.gouv.fr, also points victims to local providers. See Who should you contact after a cyberattack?.