The First Hour After a Hack, in Plain English
Last verified: October 2026
The moment you realize you've been hacked, the first hour decides a lot. Here's the calm order of steps — isolate, preserve, and call the right people — that protects your evidence, your coverage, and your recovery. Need help right now? My number is (330) 200-8042.
The First Hour, at a Glance
When you discover a hack, every instinct says to do something fast — unplug, reboot, delete, clean up. Almost all of those instincts are wrong. The right first hour is calm and deliberate: isolate the affected machine from the network but leave it on, preserve the evidence (delete nothing), call your cyber-insurance hotline first because they direct the response, then your IT help and the FBI at ic3.gov, and change passwords from a clean device. This guide walks it step by step. There's a printable 29-page version up top, with a one-page plan you can post by the computer.
Common Questions
1 What's the very first thing to do?
Stay calm and isolate the affected machine — disconnect it from the network (unplug the cable or turn off Wi-Fi) so the problem can't spread. But do not power it off or wipe it; a running machine holds evidence forensics may need.
2 Who do I call first?
Your cyber-insurance incident hotline, before anyone else. The insurer directs the response — bringing in forensics and breach lawyers, often at no extra cost — and many policies require you to notify them before spending on outside help.
3 Should I power off the computer to stop the attack?
No. Disconnect it from the network but leave it running. Powering off can erase evidence in the machine's memory that the forensics team needs to understand the attack. Your insurer's team will tell you when it's safe to shut down.
4 Can I change my passwords right away?
Yes, but from a clean device the attacker hasn't touched — your phone or a different computer — not the compromised machine. Start with email, turn on MFA, and coordinate timing with your insurer's team.
5 Why shouldn't I just clean up and reinstall?
Because cleaning up destroys the evidence that tells you what was reached and whether you have legal duties to notify customers — and it can reinfect you or overwrite a backup you need. Wait until the experts confirm it's safe and tell you the order.
6 What if I don't have cyber insurance?
Isolate and preserve the same way, then call a trusted IT professional as your first call, report to the FBI at ic3.gov, and use CISA's free resources. Afterward, strongly consider a policy — it puts a response team a phone call away next time.
Would You Rather I Just Help?
If you think you've been hacked, don't start unplugging and deleting — call me. I'll help you take the right first steps, preserve what the experts need, and make the calls in the right order. And on a calm day, I'll help you build the emergency card and the plan so you're ready. $99 flat for a visit, and for urgent help I can often start right on your screen for $49. 30-day come-back-free.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).