Clicked a phishing link? What a small business should do in the first hour

First, do not panic or hide it

The worst outcome is a click nobody mentions. Make it safe for staff to say "I think I clicked something." A fast report turns a scare into a non-event.

The first-hour checklist

1. Disconnect the device from Wi-Fi and the office network. Do not wipe it yet; you may need to see what happened.
2. If a password was typed in, change it right away from a different device, and change it anywhere else the same password was used.
3. Check multi-factor authentication on that account and sign out all other sessions.
4. Look for quiet changes: new email forwarding rules, new inbox rules that hide messages, new devices or app passwords, changed recovery phone numbers.
5. If a file was opened or a program ran, keep the device offline and get your IT provider involved before using it again.
6. Warn coworkers in case the same message went to others, and report the email to your email provider.
7. Write down what was clicked, when, and what you changed. It helps your IT provider, insurer and anyone you need to notify later.

When money or sensitive data is involved

• Banking or payment details: call your bank's fraud line now and report at ic3.gov.
• Patient, client or customer data: call your cyber insurer's claim line if you have one, and talk to your attorney. California's breach notification deadline is now 30 days in many cases. See the 30-day rule.

After the dust settles

A click is a good moment to fix the basics: multi-factor authentication everywhere, a written incident response plan, and short staff training. Keith Systems helps with incident response planning and training, and works alongside your IT provider and any forensics firm your insurer requires.