Been Breached? How to Take Your Network Offline, Step by Step

What to do, in order

1. Use the phone, not email or chat. Talk about the incident by phone. Attackers inside your network may be reading your email or chat, and CISA recommends phone calls and other out-of-band ways to communicate so they don’t learn they have been spotted.
2. Disconnect the affected computers. Leave them on. Unplug the network cable from each affected computer and turn off its Wi-Fi (airplane mode works). Don’t shut it down yet.
3. Protect your critical systems and backups. If your server, backup drive or NAS still looks normal, unplug its network cable now so it is not reached too. CISA says to isolate the systems that are essential to daily operations first.
4. If many devices are affected, take the whole network offline. CISA recommends taking the network offline at the switch when the problem is widespread. Unplug the cable between your firewall or router and your main network switch, or unplug the switch’s power. To cut the internet connection as well, unplug the cable from your internet provider’s modem to your firewall.
5. Power off only if you can’t disconnect. If a device cannot be unplugged from the network, power it down. Otherwise leave it running: shutting down erases evidence held in memory that helps show how the attackers got in.
6. Don’t wipe, reinstall or restore from backup yet. Keep everything as it is. CISA advises not rebuilding from backups until the malware that got in has been identified, otherwise you can be reinfected.
7. Write down what happened. Note the time, what you saw, which computers are affected and who noticed. Take photos of any ransom note or error message with your phone.
8. Call Fasthuma IT. During business hours (Monday–Friday, 9 AM–5 PM), call (510) 371-9468 and we’ll schedule an on-site visit as soon as possible. Outside business hours, book a free phone consultation and we’ll get back to you as soon as possible.
9. Check your cyber insurance policy. If you have cyber insurance, look up how and when your policy asks you to notify the insurer.
10. Report it. CISA suggests reporting to CISA at cisa.gov/report or (888) 282-0870 (24/7), to your local FBI field office, or to the FBI’s Internet Crime Complaint Center at ic3.gov.

Where this guidance comes from

These steps follow the U.S. Cybersecurity and Infrastructure Security Agency’s published ransomware response guidance. Read the originals:

• CISA: I've Been Hit by Ransomware!
• CISA: Ransomware Response Checklist
• CISA: Report a cyber incident
• FBI Internet Crime Complaint Center (IC3)

This is general guidance for small businesses. Every incident is different, and this page is not legal advice.