What to do in the first hour

1. Stay calm. Don't wipe, reinstall or restore yet.

   Rebuilding too early destroys the evidence that shows how the attacker got in, and they may come straight back. Don't delete suspicious emails or files either.

2. Isolate, don't power off.

   Unplug the network cable, turn off Wi-Fi or isolate the device in your EDR, but leave it running: memory holds evidence that a shutdown erases. If ransomware is actively encrypting and you can't isolate it, shutting down is the lesser evil. Block the attacker's remote access (VPN, remote desktop, exposed admin panels).

3. Preserve logs and evidence.

   Export logs from firewall, VPN, email, Microsoft 365 / Google Workspace, identity and servers now, before they rotate. Photograph ransom notes and error screens. Keep copies off the affected network.

4. Rotate credentials from a clean device.

   From a device you trust, change admin, email and remote-access passwords, revoke active sessions and tokens, and rotate API keys. Start with the accounts that can change other accounts. Check for new forwarding rules and new admin users.

5. Write down a timeline.

   What was seen, when, on which system, by whom, and every step you took, with times. It is needed for investigators, insurers and regulators.

6. Tell the right people.

   • Internally: management, your IT provider, and your cyber insurer (policies often require prompt notice and name approved responders).
   • Personal data (GDPR): if personal data may be affected, the controller must notify the Czech data protection authority ÚOOÚ without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to put people at risk (Art. 33). If the risk to people is high, inform them too (Art. 34). Record the breach either way.
   • NIS2 / Czech Cybersecurity Act: if you are a regulated service under the Cybersecurity Act (No. 264/2025 Coll.), report a significant incident to NÚKIB: an early warning within 24 hours, a notification within 72 hours and a final report within one month. Financial institutions have their own reporting under DORA to the ČNB.
   • Bank: if payments, banking access or invoice details may be affected, call your bank immediately to stop or recall payments.
   • Police: report the crime to the Police of the Czech Republic (158); you will usually need the report for insurance.

7. Don't pay a ransom before getting advice.

   Paying doesn't guarantee your data back or that it won't be leaked, and can be legally risky. Don't contact the attackers until you have expert and legal advice.

This checklist is general guidance, not legal advice. Reporting duties depend on your situation.