Cyber Incident Response for Small Business: A Step-by-Step Guide

"All our files are locked." "Customer data might have leaked." When that call comes in, do you know exactly what to do?

According to Japan's National Police Agency (NPA), ransomware attacks on small and medium businesses (SMBs) increased 37% year-over-year in 2024. About 49% of affected businesses took over a month to recover, and 50% spent over $70,000 on recovery costs alone. The trend is global — the Verizon DBIR 2025 confirms SMBs worldwide face disproportionate ransomware risk.

This article isn't about prevention — it's about what to do after you've been attacked. We cover three incident types: ransomware, data breaches, and DDoS/unauthorized access, with step-by-step instructions that work even without a dedicated IT team.

Small Businesses Are Prime Targets — The Numbers Don't Lie

"We're too small to be a target" is a dangerous myth.

According to the Verizon DBIR 2025, 88% of SMB breaches involved ransomware — more than double the overall average of 39%. The reason is simple: small businesses invest less in security, making them easy targets.

The top two intrusion methods tell the story (Sophos 2025 survey):

The second entry point — compromised credentials — is directly caused by password reuse and leaked passwords left unchecked. Running a breach check with NordPass Data Breach Scanner on your company domain can significantly reduce this risk.

The First Hour: What to Do Immediately After an Attack

Your actions in the first 60 minutes determine the scale of damage. Based on NIST SP 800-61 and CISA guidance, here's what to do — even without a dedicated IT team.

1. Disconnect from the network

Unplug the Ethernet cable. Turn off Wi-Fi. Do not power off the machine — you'll lose evidence stored in memory.

# Windows (Administrator Command Prompt)
netsh interface set interface "Wi-Fi" disable
netsh interface set interface "Ethernet" disable

# Mac/Linux
sudo ifconfig en0 down  # Wi-Fi
sudo ifconfig en1 down  # Wired LAN

2. Preserve evidence

Take screenshots of everything — ransom notes, error messages, suspicious emails. A smartphone photo of the screen counts as evidence.

Document the following:

• Timestamp (when discovered, how it was found)
• Scope (which machines, which systems)
• Actions taken (what was done before and after discovery)

3. Notify key contacts

Ransomware Response: Step-by-Step Recovery Without Paying

When your screen shows "Your files have been encrypted. Pay Bitcoin to decrypt" — follow these steps.

What NOT to do

• Don't pay the ransom. According to Veeam's 2025 research, 36% of organizations refused to pay, and 25% recovered their data without paying at all. Payment doesn't guarantee decryption
• Don't restart the infected machine. Decryption keys in memory may be lost
• Don't create backups after infection. The backup destination can become infected too

Step 1: Identify the ransomware

Check the file extension of encrypted files (.locked, .crypt, etc.). Upload a sample to ID Ransomware (https://id-ransomware.malwarehunterteam.com/) to identify the specific variant.

Step 2: Search for decryption tools

Check No More Ransom (https://www.nomoreransom.org/) for free decryption tools. This Europol-backed project covers 200+ ransomware families.

Step 3: Restore from backup

If you have offline backups (not connected to the infected network):

1. Clean-install the OS on infected machines
2. Restore data from backup
3. Change all account passwords

If no backup exists, contact a digital forensics firm. It's expensive, but cheaper than total data loss.

Step 4: Reset all passwords company-wide

Whether or not the intrusion came through compromised credentials, reset all passwords as a precaution. A password manager lets you deploy strong, unique passwords to every employee instantly.

Data Breach Response: Legal Obligations and Notification Steps

Customer PII, employee records, trade secrets — what leaked determines your response.

Notification requirements vary by jurisdiction

Step 1: Determine the scope

• Which databases/files were accessed?
• How many records are affected?
• How long was the breach active? (Check access logs)

Step 2: Stop the bleeding

• Close the breach vector (disable compromised accounts, patch the vulnerability, take the app offline)
• Monitor for leaked data on dark web marketplaces

Step 3: Notify and report

1. File the required regulatory report
2. Notify affected individuals (email/mail)
3. Issue a press release if the scale warrants it
4. Inform business partners

Step 4: Prevent recurrence

• Fix the root cause (patch, access control review)
• Reset all company passwords
• Set up continuous monitoring with NordPass Data Breach Scanner on your company domain

DDoS and Unauthorized Access: Containment Playbook

"The website suddenly got slow." "Someone logged in from an unknown IP." These are incidents too.

DDoS attacks

1. Check your CDN/WAF: If using Cloudflare, enable "Under Attack Mode"
2. Contact your ISP: Request upstream filtering
3. Preserve access logs: Record attacker IPs (needed as evidence)
4. Report to authorities: DDoS may constitute a criminal offense in your jurisdiction

Unauthorized access

1. Disable the compromised account immediately
2. Terminate all active sessions
3. Identify the entry point from access logs (SSH? Admin panel? API?)
4. Close the entry point (close ports, add IP restrictions, enforce MFA)
5. Check for lateral movement to other systems

Five Things to Do After the Incident Is Over

The attack has stopped, but your work is just beginning.

1. Write an incident report

Document everything:

• Timeline (detection, response, resolution)
• Scope (affected systems, data, duration)
• Root cause
• Remediation actions taken
• Lessons learned

This report is essential for client communication, insurance claims, and legal proceedings.

2. Fix the root cause

"We strengthened our firewall" isn't enough. If the cause was password reuse, deploy a password manager company-wide. If it was an unpatched server, establish a patch management process.

3. Consider cyber insurance

With 50% of SMB recovery costs exceeding $70,000, cyber insurance is a rational business decision. Many policies cover forensics, legal fees, and notification costs.

4. Train your employees

While the incident is still fresh in everyone's mind, run a company-wide security training session. CISA's free resources for small businesses are an excellent starting point.

5. Update your response plan

Incorporate lessons from this incident into the response plan from the next section. Document specific improvements so you're better prepared next time.

Build Your Incident Response Plan Today (Free Checklist)

According to the Sophos 2025 survey, most small businesses lack a formal incident response plan. Creating one today puts you ahead of the vast majority of businesses.

At minimum, write down the following on a single sheet of paper:

Contact list

Immediate response checklist

• Disconnect from network (unplug Ethernet / turn off Wi-Fi)
• Screenshot everything visible on screen
• Notify incident lead
• Initial scope assessment (which machines, which data)
• Preserve evidence (logs, emails, screenshots)
• Decide whether to report to CISA / law enforcement
• If personal data may be involved → prepare breach notification

Prevention checklist

• Regular offline backups (at least weekly)
• Password manager deployed company-wide
• VPN for all remote access
• Automatic OS and software updates enabled
• MFA enabled on all accounts

Wrapping Up

Cyberattacks are not a matter of "if" but "when." SMB incidents continue to rise, with 116 ransomware cases reported to Japan's NPA in the first half of 2025 alone — a record high for any half-year period.

The most critical factor is what you do in the first hour. Network isolation, evidence preservation, and contacting the right people — executing these three steps immediately can reduce damage by orders of magnitude.

Print the checklist from this article and pin it to your office wall. That single sheet of paper might save your business someday.

Related articles:

• SMB Cybersecurity Guide: 5 Steps for 2026
• Remote Work Security Checklist for Freelancers
• How to Check If Your Password Has Been Leaked
• SSH Security Guide: From Key Auth to VPN-Only Access
• NordPass Business Review: Best for Small Teams?