The logic-IT team gets calls most weeks from Georgia small-business owners who suspect a breach. The conversation usually starts the same way: someone noticed something wrong, spent a few minutes clicking around trying to confirm it, and then called their bank. By the time a technician gets involved, the situation is harder to contain and harder to investigate than it needed to be.
Good intentions cause most of the damage in the first few minutes. Knowing two or three specific actions ahead of time changes the outcome.
Disconnect the Machine, Do Not Shut It Down
Pull the network cable or turn off Wi-Fi on the affected computer. If it is on a wired connection, unplug the ethernet cable from the back of the machine. If it connects wirelessly, disable the Wi-Fi adapter through the system tray or physically switch off the router port if you know how.
Do not press the power button. Shutting down a machine can overwrite data sitting in memory, including process logs, active connection records, and temporary files that show exactly what ran and when. Your IT technician needs that evidence to understand what happened and how far it spread. Powering off the machine can erase it before anyone has a chance to look.
Leave the screen as it is. Do not close windows, do not log out, do not open Task Manager to see what is running. Every action you take on that machine after a suspected breach risks changing the forensic picture.
Stop Touching It and Call Your IT Provider
Once the machine is off the network, your job is done on that device. Call your managed IT provider before you call your bank, before you tell your staff, before you start checking other computers yourself.
A technician can walk you through whether other machines on the same network need to come offline. They can check firewall logs, review access records, and determine whether the attacker reached any credentials. Your bank will need to hear from you eventually, but they cannot tell you how the attacker got in or whether the attacker is still active somewhere on your network.
If you do not have a managed IT provider on call, write down everything you remember: what you saw on screen, what time you noticed it, what you or anyone else clicked before you disconnected. That timeline helps whoever investigates next.
What Makes the First Five Minutes So Consequential
Ransomware can encrypt files across a network in under ten minutes once it starts moving. A credential-stealing tool can forward a copy of your email to an outside address within seconds of running. The faster you cut the affected machine off from everything else, the smaller the window the attacker has to pull more data or cause more damage.
Forensic evidence degrades fast too. Memory clears on shutdown, logs roll over, and timestamps become harder to trust the longer a compromised machine stays active on the network. The technician who arrives an hour later has much better material to work with if someone isolated the machine quickly and left it alone.
Build a One-Page Plan Before You Need It
A short written plan posted near your server or shared in your team’s communication tool removes the guesswork when someone is panicking. Include the IT provider’s emergency number, the steps to disconnect a machine from your specific network setup, and a note reminding staff not to shut anything down.
- Post the IT provider’s after-hours number somewhere visible, not just saved in one person’s phone.
- Label the ethernet ports or switches that correspond to each workstation so anyone can isolate a machine without knowing the full network layout.
- Decide in advance who has the authority to take a machine offline, so no one hesitates waiting for a manager.
logic-IT works with Georgia small businesses on exactly this kind of preparation. If you do not have a written response plan and a provider you can call at 7 a.m. on a Tuesday, that gap is worth closing before something happens.
Dealing with something similar at your business?
We can help. Talk to the logic-IT team today.