Guide
Hacked? What to Do in the First Hour (Email, Ransomware or Fake Invoices)
A calm, step-by-step checklist for Wisconsin businesses and families when email is hacked, ransomware hits or a fake invoice gets paid, plus how to keep it from happening again.
Short answer: disconnect affected computers from the network (but do not turn them off), change passwords from a different, clean device, call your bank right away if any money moved, and call for help. Fast, calm action in the first hour limits the damage more than anything else.
If email was hacked
- Change the password from a clean device and turn on multi-factor sign-in.
- Sign out of all sessions and check for forwarding rules the attacker added.
- Warn customers and vendors not to act on payment changes sent from your account.
- Check what the attacker could see, especially invoices and bank details.
If a fake invoice was paid
- Call your bank immediately and ask for a recall of the transfer. Minutes matter.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Secure the email account that was used or spoofed.
If ransomware hits
- Disconnect affected computers from the network; leave them powered on.
- Do not pay or contact the attackers before getting professional advice.
- Call your cyber insurer if you have one; they often have a required process.
- Restore from backups that were not connected to the network.
Afterward: stop it from happening again
- Multi-factor sign-in on email, banking and remote access
- Backups that ransomware cannot reach, tested regularly
- Email security (DMARC and phishing filters) and staff training
- A simple rule: verify every payment change by phone, using a known number
We help Wisconsin businesses and families right away. See cyber incident response.
Frequently asked questions
Should we turn the computer off?
No. Disconnect it from the network instead. Powering off can destroy evidence that helps figure out what happened.
Do we have to report a breach?
It depends on what data was involved and where your customers live. Wisconsin has a data breach notification law, so get advice quickly if personal information may have been exposed.
Can our bank get the money back?
Sometimes, if they act quickly. That is why calling the bank comes before everything else when money has moved.