What to Do If Your Business Is Hacked

Use a safe way to reach your team

If business email may be affected, use a trusted phone or another safe way to communicate. Tell the people named in your response plan. Do not send passwords or customer files through a suspect account.

Stop the spread with qualified help

Ask your response team to identify affected systems and isolate them from the network. Do not wipe computers or delete messages as a quick fix. Response experts may need them to find out what happened.

Turning off a device can destroy short-lived evidence. Let the response team guide that decision where possible. Urgent containment may still be needed.

Notify the right insurance contact

Use the claims or incident contact named in your policy. Do not assume that leaving a message for an agent meets every reporting rule.

Ask about required providers and approval before spending money. This should happen alongside urgent response, not become a reason to let the attack spread.

Call the bank if money is at risk

If a fraudulent payment was sent, call the bank now and ask about stopping or recalling it. Make a report to FBI IC3 (opens in a new tab). Also follow the policy’s reporting process.

Keep a simple record

• When you first saw the problem.
• What you saw and who reported it.
• Who was contacted and when.
• Actions taken and who approved them.
• Bills, claim numbers, and key messages.

Keep original records safely. Do not put exposed customer information in a public post or an ordinary contact form.

Get advice about notices

You may need to notify customers, regulators, or others. The duties depend on the business, information, law, contracts, and facts. Have appropriate counsel help identify the notices and deadlines. Reporting to an insurer or law enforcement does not replace these duties.

If there is no cyber policy

You still need to respond. Contact your qualified response team and appropriate counsel. Ask a licensed insurance professional to check whether any existing policies could apply. Do not assume a new policy will cover an event you already know about.

Prepare before the next event

Keep a current response plan and contact list. Test the plan with the people who will use it. Open the claim-readiness checklist.

For advisory questions, contact Infosec Check. This contact route is not an insurer’s claim hotline and does not promise immediate incident response.

Return to the cyber coverage hub.

Scope

This guide gives general information. It does not decide a claim or change a policy. Coverage depends on the policy, its added forms, the facts, and the law. Ask a licensed insurance professional about your coverage and a lawyer about legal questions.

Sources

• CISA: StopRansomware Guide (opens in a new tab)
• FBI IC3: Business Email Compromise (opens in a new tab)
• Travelers: CyberRisk Applications and Sample Forms (opens in a new tab)
• FTC: Safeguards Rule Business Guide (opens in a new tab)