Why this matters
In a live incident, the instinct is to delete, reset, and hope which destroys evidence and often leaves the attacker inside. A clear response plan turns panic into a sequence of decisive, recoverable steps.
Step by step
- Disconnect affected devices from the internet to contain the spread.
- Change passwords for critical accounts from a clean, trusted device.
- Document what happened, including times, messages, and any unusual activity.
- Notify your bank, key contacts and, where relevant, the authorities.
- Restore from clean backups and have devices professionally checked before reuse.
BlackCloak tips
Do not delete evidence or wipe devices before they are examined, as this can erase vital clues. Keep an offline copy of emergency contacts so you can act even if accounts are locked. Never negotiate with or pay an extortion attempt before taking advice, get expert help early.