Guide

# Hacked? What to Do in the First Hour (Email, Ransomware or Fake Invoices)

A calm, step-by-step checklist for Wisconsin businesses and families when email is hacked, ransomware hits or a fake invoice gets paid, plus how to keep it from happening again.

By the Wisconsin Tech Shop team · Updated October 31, 2026

**Short answer:** disconnect affected computers from the network (but do not turn them off), change passwords from a different, clean device, call your bank right away if any money moved, and call for help. Fast, calm action in the first hour limits the damage more than anything else.

## If email was hacked

- Change the password from a clean device and turn on multi-factor sign-in.
- Sign out of all sessions and check for **forwarding rules** the attacker added.
- Warn customers and vendors not to act on payment changes sent from your account.
- Check what the attacker could see, especially invoices and bank details.

## If a fake invoice was paid

- **Call your bank immediately** and ask for a recall of the transfer. Minutes matter.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Secure the email account that was used or spoofed.

## If ransomware hits

- Disconnect affected computers from the network; leave them powered on.
- Do not pay or contact the attackers before getting professional advice.
- Call your cyber insurer if you have one; they often have a required process.
- Restore from backups that were not connected to the network.

## Afterward: stop it from happening again

- Multi-factor sign-in on email, banking and remote access
- Backups that ransomware cannot reach, tested regularly
- Email security (DMARC and phishing filters) and staff training
- A simple rule: verify every payment change by phone, using a known number

We help Wisconsin businesses and families right away. See [cyber incident response](https://wisconsintechshop.com/cybersecurity/incident-response/).

## Frequently asked questions

### Should we turn the computer off?

No. Disconnect it from the network instead. Powering off can destroy evidence that helps figure out what happened.

### Do we have to report a breach?

It depends on what data was involved and where your customers live. Wisconsin has a data breach notification law, so get advice quickly if personal information may have been exposed.

### Can our bank get the money back?

Sometimes, if they act quickly. That is why calling the bank comes before everything else when money has moved.

## Related services

- [Cyber Incident Response (Hacked, Ransomware or Breach)](https://wisconsintechshop.com/cybersecurity/incident-response/): Hacked, locked out or hit by ransomware? We help right away: contain the damage, find out what happened, restore systems and guide your next steps. (From $500)
- [Hacked Email & Wire Fraud Help](https://wisconsintechshop.com/cybersecurity/business-email-compromise/): When criminals get into an email account, they hide forwarding rules and send fake invoices. We lock them out, clean up and help stop the money. (From $300)
- [Ransomware Protection & Recovery Planning](https://wisconsintechshop.com/cybersecurity/ransomware-protection/): Make ransomware a bad day instead of a disaster: layered protection, backups attackers cannot touch and a tested plan to get running again. (From $500)
- [Home Cybersecurity & Identity Theft Help](https://wisconsintechshop.com/cybersecurity/home-cybersecurity/): Protect your family’s accounts, money and identity: secure email and bank logins, freeze credit, clean up hacked accounts and avoid the next scam. (From $100)

## Related quick fixes

- [Microsoft 365 Account Blocked for Suspicious Activity](https://wisconsintechshop.com/fix/microsoft-365-account-blocked/)
- [Google Says Your Site Is Dangerous or Deceptive](https://wisconsintechshop.com/fix/site-flagged-dangerous-by-google/)
- [Japanese or Spam Pages Showing for Your Site in Google](https://wisconsintechshop.com/fix/spam-pages-in-google-for-my-site/)
- [Website Redirecting to Spam or Scam Sites](https://wisconsintechshop.com/fix/website-redirecting-to-spam/)
- [Web Host Suspended Your Website](https://wisconsintechshop.com/fix/hosting-account-suspended/)
- [Clicked a Phishing Link or Entered Your Password](https://wisconsintechshop.com/fix/clicked-phishing-link/)
- [Are Your Backups Actually Working](https://wisconsintechshop.com/fix/test-your-backups/)

[All tech fixes](https://wisconsintechshop.com/fix/)

## Tell us what you need

Get a free, no-pressure quote from a Wisconsin development team. Tell us a little about your business and we'll reply within one business day with next steps, rough pricing and honest advice.

- Big projects and small ones are all welcome
- Fixed-price quotes, no surprise invoices
- You own your code, data and accounts
- A client portal to track progress, invoices and payments
- Rooted in Wisconsin, serving businesses nationwide

---
Source: https://wisconsintechshop.com/guides/what-to-do-if-your-business-is-hacked/
Contact: hello@wisconsintechshop.com · https://wisconsintechshop.com/contact/