Incident Response for Small Business

Incident response: what to do right now if you've been hacked

Make two calls before you touch the affected systems: your cyber insurer's breach hotline, if you have a policy, and the FBI at ic3.gov or your local field office ². Then preserve evidence. The FTC's breach guide is blunt: do not destroy evidence ³.

Why the order matters:

• The insurer first. The FTC tells businesses to ask insurers whether they offer a breach hotline available at all hours ¹. Many policies require you to use the insurer's panel lawyers and forensic firms. Hiring your own first can put reimbursement at risk, so read your policy or ask the hotline.
• Law enforcement early. The FBI asks ransomware victims to contact a field office or file at ic3.gov ². Treasury's sanctions office treats a prompt, complete report to law enforcement as a significant mitigating factor if a ransom payment later turns out to involve a sanctioned party ¹⁰.
• Evidence before rebuilding. Wiping and reimaging feels like progress, but it destroys the logs that show how attackers got in, what they took, and whether you have to notify anyone. CISA advises isolating affected systems and taking a system image and memory capture of a sample of affected devices ¹¹.

Isolate rather than shut down where you can: unplug network cables or disable Wi-Fi on affected machines. CISA says to power devices down only if you cannot disconnect them from the network ¹¹. Change passwords from a clean device, starting with email admin, banking and backup accounts.

Ransomware attack: what to do and what it costs

After a ransomware attack, contain it, preserve evidence, check whether your backups survived, and only then decide how to recover. In Sophos's 2026 survey of organizations with 100 to 5,000 employees, the average recovery cost was $1.7 million, the median ransom payment was $769,000, and 48% of organizations whose data was encrypted paid ⁸¹². Coveware put the median payment at $150,000 and the average at $1,880,612 in Q2 2026, with the share of victims paying at a record low ⁹.

On paying:

• The FBI does not support paying a ransom and notes that payment does not guarantee you get your data back ².
• Paying a group with a sanctions link can create legal exposure of its own, which is why insurers and counsel check this before any payment ¹⁰.
• Many attacks now steal data before encrypting it. Even with good backups, you may still face extortion over the stolen files, and notification duties.

Ransomware recovery services rebuild systems, restore from clean backups, reset every credential and confirm the attacker is gone before users go back online. Whether you can skip the ransom depends on backups the attackers could not reach. Sophos found 60% of US organizations used backups to recover encrypted data ²⁰. Our backup and disaster recovery guide covers immutable and offline copies.

Hacked business email and wire fraud

If an email account was taken over or a payment went to a fraudster, call the bank that sent the money immediately and ask for a recall. The FBI's IC3 tells business email compromise victims to contact the originating financial institution as soon as fraud is recognized and to file a detailed complaint at ic3.gov that includes the banking information ¹³. Speed matters: requesting a recall quickly may reduce or eliminate the loss ¹³.

Business email compromise is the most expensive common attack on smaller firms. It caused about $3.05 billion in reported losses in 2025 across 24,768 complaints to IC3 ¹⁴. Among Coalition's policyholders, BEC claims averaged $27,000 and funds transfer fraud claims $141,000 in 2025, and Coalition recovered $21.8 million in stolen funds for policyholders ¹⁵.

After the bank call:

• Reset the account password from a clean device and sign out all sessions.
• Check for mail forwarding rules and inbox rules the attacker added.
• Turn on MFA for every mailbox if it is not already enforced.
• Review what the attacker could read. If the mailbox held personal data such as Social Security or account numbers, notification laws may apply.

If an employee only clicked a phishing link, have them change their password, check sign-in logs for unknown locations, and run a scan on the device. Our cybersecurity for small business guide covers email security controls that stop most of this.

Breach notification duties by state and industry

Every state, DC, Puerto Rico and the US Virgin Islands has a breach notification law ³, and deadlines are getting shorter. Some examples from the statutes:

• California: notify affected residents within 30 calendar days, and send a sample notice to the Attorney General when more than 500 residents are notified ⁴.
• New York: no later than 30 days after discovery, with notice to the Attorney General, Department of State and State Police ⁵.
• Texas: no later than 60 days, and the Attorney General within 30 days if 250 or more Texans are affected ⁶.
• Florida: no later than 30 days, and the Attorney General if 500 or more Floridians are affected ⁷.

The law that applies is usually the state where each affected person lives, not where your office is. Our city pages summarize the local rule, for example managed IT in New York and managed IT in Dallas.

Industry rules stack on top:

• Healthcare (HIPAA): individuals within 60 days of discovery, and HHS at the same time for breaches of 500 or more ¹⁶. See our HIPAA compliance services guide.
• Tax preparers and other non-bank financial firms (FTC Safeguards Rule): the FTC within 30 days when 500 or more consumers' unencrypted data is acquired ¹⁷. See our WISP guide.
• Defense contractors (DFARS 252.204-7012): report to DoD within 72 hours and preserve system images for at least 90 days ¹⁸. See our CMMC overview.

This is not legal advice. Have breach counsel confirm which laws apply before notices go out.

Incident response services and retainers

Incident response services are usually bought one of three ways: through your cyber insurer, on a pre-arranged retainer, or as an emergency engagement after something goes wrong. A typical response team includes breach counsel, forensic investigators, recovery engineers and sometimes ransom negotiators and a notification vendor.

Through insurance. If you have a cyber policy, the insurer's panel firms usually handle the response and the policy pays within its limits. The FTC lists forensics, data recovery, customer notification and legal counsel among typical first-party coverage costs ¹. Coalition reports that 64% of the claims it closed were resolved with no out-of-pocket loss for the policyholder ¹⁵.

On retainer. An IR retainer pre-agrees terms, rates and response commitments so a firm is ready before you need it. Some retainers use prepaid hours that can be spent on planning or testing if no incident happens. We have found no neutral, published survey of IR retainer pricing, so compare written quotes on response commitment, hourly rate, what unused hours can be used for, and whether the firm is on your insurer's panel.

In an emergency. Without insurance or a retainer, you will sign terms at the worst moment. If you are insured, use the hotline first. If not, ask the responder for a written scope and rate before work starts.

Smaller firms often pair a retainer with managed detection and response, since an MDR provider can isolate machines within its service and hand off to IR when needed.

Build a data breach response plan before you need one

A short written incident response plan, tested once a year, is the cheapest part of incident response. Some rules require one. The FTC Safeguards Rule requires a written incident response plan for covered financial institutions, except those holding data on fewer than 5,000 consumers ¹⁷. The SEC's amended Regulation S-P requires covered institutions to have a written incident response program ¹⁹.

A useful plan fits on a few pages:

• Who decides, with names, phone numbers and backups, kept on paper and outside company email.
• Your insurer's hotline number and policy number.
• Your IT provider, bank fraud line and breach counsel contacts.
• Where backups are, and who can restore them.
• What data you hold on customers and employees, and in which states they live.
• A simple order of steps that matches the six in the box above.

Run a one-hour tabletop exercise each year where leadership walks through a ransomware or wire fraud scenario. A cybersecurity risk assessment or a vCISO can draft and test the plan with you. Insurers also ask whether you have one, as covered in our cyber insurance requirements guide.