3 September 2026LANTEK Computers
If this is happening right now, do these six things in this order. The reasoning is further down.
- Do not switch anything off. Disconnect it from the network instead. Pulling the power destroys evidence you may need and can make the damage worse.
- Change the passwords on the accounts that matter, and force every session to sign out. Start with email and anything that can authorise a payment.
- Write down the time and what you saw. Start a single running log with times against each entry. You will not remember the order tomorrow.
- Tell one person they own this. One decision maker, named, for the duration.
- Stop all payment changes. Any request to change banking details, from anybody, in writing or by telephone, is on hold until this is resolved.
- Get help on the phone. Your IT provider, and if personal information may be involved, your attorney.
Everything below explains why that order, and what the rest of the day looks like.
Why disconnecting beats switching off
The instinct is to kill the power, and it is the wrong instinct twice over.
The first reason is evidence. A great deal of what tells you how somebody got in, how long they were there and what they reached lives in memory and in logs that are still being written. Cutting power loses some of that permanently, and you may need it to answer the only question that really matters afterwards: whose information was actually affected.
The second reason is that with some ransomware, an abrupt shutdown mid encryption leaves files in a worse state than a clean disconnection would have.
Unplug the network cable. Turn off the wireless. Leave the machine running. If the machine is a server that other things depend on, that decision needs somebody technical on the call, which is why item six is on the list.
Why passwords come before investigation
Because in most incidents the way in was a working password, and while it still works, whatever is happening continues while you investigate.
Two details matter. Changing a password does not always end an existing session, so you need to sign sessions out as well, and your provider will know where that setting lives. And turning on multi-factor authentication now, if it was not on, is the single most effective thing you can do in the first hour, because it stops the same credential being reused an hour later.
Do email first. Email is the account that resets every other account.
Why the log matters more than it seems
A plain document, times down the left, what happened and who did it on the right. Every action you take goes in it, including the ones that turn out to be wrong.
You are writing it for three audiences. Yourself in a week, when the sequence has blurred. Your insurer, if there is a cyber policy, because they will ask what was done and when. And potentially the Information Regulator, whose interest is not only in what happened but in whether you responded reasonably. A contemporaneous log is the difference between demonstrating that and asserting it.
Why one named owner
Because the common failure in the first day is not technical. It is four people each assuming somebody else has told the bank, or the client, or the provider.
One person owns the decisions and the communication. They do not have to be technical. They do have to be senior enough to say no to a payment and to authorise spending. In most small businesses this is a director, and in practice it is often the same person who is the Information Officer whether they were formally appointed or not.
Why payments freeze immediately
Because a great many incidents that look like a security problem are, underneath, an attempt to redirect money. Somebody with access to a mailbox watches for an invoice, then sends a plausible request to change banking details from a real address inside a real conversation.
So: no banking detail changes while this is open. Any that were actioned in the last month get verified by telephone, on a number you already held, not one from the email. If a payment has already gone, telephone your bank now rather than at the end of the day. Speed genuinely affects recovery.
How that pattern works in detail is covered in how business email compromise actually works.
The rest of the first day
Work out the scope, carefully
The question is not how did they get in. It is what could they reach. Which mailboxes, which shared folders, which systems that account had rights to. Resist the urge to conclude early. Most first assessments turn out to be too narrow, and a notification based on a too narrow assessment has to be corrected later, which is materially worse than a slower, accurate one.
Look for what they left behind
Specifically, inbox rules that forward or hide mail, added recovery addresses or phone numbers, and any new mailbox delegation. These outlive a password change, and finding one is also confirmation that the access was deliberate rather than accidental.
Check the backup before you need it
Establish that you have a restore point from before this started, and that somebody can actually restore from it. Do not assume. If the backup is reachable from the compromised network, get it isolated.
Take advice on notification
This is where you need your attorney rather than your IT provider. POPIA requires notification to the Information Regulator, and to the people affected, where there are reasonable grounds to believe personal information has been accessed or acquired by somebody unauthorised. The Act frames the timing as as soon as reasonably possible after discovering it, which is deliberately not a fixed deadline, and the judgement about whether the threshold is met is a legal one.
Two things to hold on to. Not every incident is notifiable. And the assessment should be written down either way, including the reasoning if you conclude it is not, because the reasoning is what you would need to show. When you have to notify, and when you do not goes into the test itself. None of this is legal advice, and it is not a substitute for your own.
Tell your insurer early
If there is a cyber policy, most have notification conditions and some require their own responders be used. Calling them late can affect a claim.
Things worth not doing
Do not email everybody an update until you know the mailbox is clean. You may be briefing the person who is still reading it.
Do not reinstall the affected machine on day one unless you have to. It is the evidence.
Do not negotiate with anybody yourself if there is a ransom demand. That conversation involves your attorney and your insurer, and there are legal considerations beyond whether the money would work.
Do not say publicly that no data was affected before you know. Correcting that statement later does more damage than the original silence.
The thing to do before any of this happens
Decide now who the named owner is, write down the telephone numbers you would need at eleven at night, and confirm somebody has restored from your backup. Those three take an afternoon and they change how the first hour goes.
If you are in this today, telephone us rather than filling in a form. What continuous monitoring looks like, and why it shortens the gap between something starting and somebody noticing, is on 24/7 Monitoring and Response.