First Hours After a Suspicious Digital Event

The first hours after a suspicious digital event decide how much damage gets locked in. Disconnect the affected device from the network, change the password on the compromised account from a different device, and preserve what you saw before you clean anything up. Everything else follows from those three moves.

What are the first steps after a phishing link is clicked?

Treat the click as a possible credential exposure, not as a confirmed breach. The distinction matters because it changes what you do first: you are trying to cut off access before an attacker uses it, not to repair a system that has already been damaged.

Start by not entering anything else. If the page asked for a password and you typed it, that password is now in someone else's hands. Close the tab, and do not try to log in again through the same link to check whether it worked.

Move to a different device, one you believe is clean, and change the password for the account involved. If you reused that password anywhere else, change it there too, starting with email, banking and any account that can reset the others. Email comes first because a compromised inbox can be used to reset almost everything else you own.

Then look at the account's own activity, not the phishing page. Check active sessions, recent sign-in locations, and any forwarding or filter rules you did not create. A hidden forwarding rule is one of the quietest ways an attacker keeps reading mail after you change the password.

If the click happened on a work device, tell whoever handles IT before you start deleting things. A single report in the first hour is worth more than a tidy cleanup that destroys the evidence. A structured reference such as this incident response guide walks through the same sequence for accounts, devices and small teams, which is useful when nobody in the room has done this before.

Finally, run a full antivirus or anti-malware scan, and do not assume a clean result closes the file. A scan catches known threats. It does not catch a session token that was already stolen, which is why the password change and the session review matter more than the scan.

How is a hacked account recovered and its active sessions closed?

Recovery has two goals that are easy to confuse: getting back in, and getting the attacker out. Most people stop at the first one.

If you can still sign in, change the password immediately, then revoke every active session. On most major platforms this is a single control labelled something like "sign out of all devices" or "end all sessions." Use it. Changing a password alone often leaves existing sessions alive, which means the attacker stays logged in while you believe the problem is solved.

If you cannot sign in, use the account recovery flow. Expect it to be slower than you want, and expect it to ask for a recovery address or phone number the attacker may have already changed. If the recovery contact details were altered, go through the platform's account compromise form rather than the standard reset page.

Once you are back in, work through this list in order:

• Recovery email and phone number, restored to ones you control.
• Forwarding rules, filters and delegated access, checked line by line.
• Connected apps and third party access, revoked where you do not recognise the app.
• Two-factor authentication, re-enrolled, ideally with an authenticator app or a passkey rather than SMS.
• Password manager entries, updated so the old password is not sitting in a vault entry you forgot about.

Tell the people who might be targeted next. If the account belongs to a business, that includes clients, suppliers and anyone who received mail from it during the exposure window. A short, plain notice beats a vague one.

What should a small team prepare before a ransomware incident?

Preparation for ransomware is mostly paperwork and one decision, not technology. The technology matters, but it is not what fails first.

The decision is who can authorise taking systems offline. In a small organisation, that is usually the owner or a single operations lead. Write the name down, add a backup name, and make sure both know the answer is yes without needing a meeting.

The paperwork is a one page response plan. It does not need to be a framework. It needs the names and numbers of the people to call, the order in which systems get isolated, where the offline copy of the plan lives, and a line stating that no ransom is paid without a decision from the named authority. Keep a printed copy, because the plan stored only on the affected network is not a plan.

Then check the recovery side, because that is what determines whether an incident is a bad week or a closed business:

• Backups exist, are recent, and are stored somewhere that is not reachable with the credentials used day to day.
• A restore has actually been tested, not just configured. An untested backup is a hope.
• The restore time is known. If a full recovery takes four days, the team should know that before the incident, not during it.

Add a reporting route for phishing. One mailbox or one person, known to everyone, so a suspicious message gets reported in minutes instead of being forwarded around for a day. Most ransomware starts with a single set of credentials, and the reporting habit is what shortens the gap between the click and the response.

Why the order of steps matters more than the tools

Small teams tend to buy tools before they write down a sequence. The sequence is cheaper and it is what holds up under pressure.

A workable order for the first hours looks like this: isolate, preserve, notify, then remediate. Isolate the affected device or account so the problem stops spreading. Preserve logs, screenshots and the original message before anything is deleted or reinstalled. Notify the people who need to act, including your insurer or legal advisor if client data is involved. Only then start cleaning, rebuilding and resetting.

Reversing that order is common and costly. Reinstalling a laptop in the first hour feels productive, but it usually destroys the only record of how the attacker got in, which means the same entry point stays open.

What to write down while it is happening

Keep a running log from the first minute. Time of discovery, who noticed, what was seen, what was done, who was told. It takes one person and a shared document.

The log serves three purposes. It keeps the team from repeating steps. It gives your insurer, your accountant or your lawyer a factual record if the incident has financial or legal consequences. And it turns the incident into something you can actually learn from, because memory of a stressful day is unreliable within about 48 hours.

For Canadian businesses, note that privacy obligations can attach quickly if personal information was involved. The Office of the Privacy Commissioner of Canada publishes guidance on when a breach must be reported and what records to keep, which is worth reading before you need it rather than during.

The short version

Disconnect, change the password from a clean device, close every active session, preserve the evidence, and tell the right people early. Prepare the one page plan and the tested backup before anything happens, because those two items decide how the first hours go. Nothing on this list requires a security specialist on staff, only a decision about who is allowed to act.