Cyber incident response for small and medium offices
A hacked mailbox, a ransom note on the server or a fake invoice that got paid all need fast, calm and careful action. We help you contain the damage, keep the evidence, get working again on clean systems and work out what needs to be reported.
Cyber incident response for small and medium businesses
The first hour after spotting an incident decides much of what follows. The natural reaction is to delete the strange email, wipe the infected laptop or quietly change one password and hope. Each of those can make things worse: the attacker may still hold other accounts, the evidence of how they got in disappears, and you lose the ability to say with confidence what information was exposed. A short, practised routine is far more useful than speed for its own sake.
Our routine starts with containment. We disconnect affected devices from the network without switching them off, reset passwords and sign-in sessions for compromised accounts, check mailbox rules and forwarding that attackers commonly add, and block the routes they used. If money may have been sent to a fraudulent account, the first call is to your bank, as quickly as possible. Then we work out the scope: which accounts, which devices, what data, and over what period.
Recovery comes once the threat is contained. Systems are rebuilt or restored from backups taken before the compromise, sign-in protection is tightened and staff are walked through what changed. We write up a timeline you can give to your insurer, and help you think through whether the event is a notifiable privacy breach and whether to report it to the National Cyber Security Centre. For legal advice we recommend involving your lawyer, and we work alongside them.
What's included
Fast triage
A quick assessment of what is happening, which systems are involved and what to do in the next few minutes, given in plain language.
Containment
Affected devices isolated, compromised accounts locked down, malicious mailbox rules removed and the attacker's access routes closed.
Evidence preservation
Sign-in logs, audit records and affected machines kept intact where possible, so you can later show what was and was not accessed.
Scope investigation
A review of Microsoft 365 sign-ins, mailbox activity, file access and device alerts to work out how far the incident reached.
Clean recovery
Systems rebuilt or restored from known-good backups, with passwords, keys and sessions reset so the attacker cannot simply walk back in.
Notification support
Help assembling the facts you need to decide on notifying affected people, the Privacy Commissioner, your insurer and the NCSC.
Incident report
A written timeline of what happened, what was done and what was changed afterwards, suitable for insurers, auditors and your own records.
Lessons and fixes
Practical changes to stop the same thing happening again, such as stronger sign-in rules, payment verification steps or staff awareness training.
Who is cyber incident response for?
Get in touch about incident response if:
- Clients have received strange emails or invoices that appear to come from you
- A ransom note or encrypted files have appeared on a computer or server
- Money has been paid to a bank account that turned out to be fake
- Someone signed in to a staff account from a location that makes no sense
- You want a written plan in place before anything goes wrong
- Your insurer requires a named contact for cyber incidents
Not sure where to start?
Our free IT health check looks at your devices, accounts, backups, security and network. You get a short written report with what is working, what is at risk and a price to fix it. No obligation.
Book the health checkCyber incident response questions
What should we do first if we think we have been hacked?
Don't wipe or switch off affected computers; unplug them from the network or turn off their Wi-Fi instead. If money is involved, ring your bank immediately. Then contact us and your insurer, and write down what you noticed and when.
Do we have to report a cyber incident?
Under the Privacy Act 2020, a privacy breach that has caused or is likely to cause serious harm must be notified to the Privacy Commissioner and the affected people as soon as practicable. Not every incident meets that bar. We help gather the facts, and your lawyer can advise on the decision.
Who is CERT NZ now?
CERT NZ's functions are now part of the National Cyber Security Centre (NCSC). Businesses can report incidents to the NCSC, which uses reports to warn others and can offer guidance. Reporting there is separate from any privacy notification duty.
Should we pay a ransom?
That is a decision for the business, its insurer and its legal advisers, not for us. Paying does not ensure you get data back or that it is deleted. Good, separate backups are what give you a real choice.
Is incident response included in our plan?
Containment for clients on a support plan is handled as priority work. Larger recoveries, investigations or rebuilds are quoted in writing first once the scope is clear, so you know the cost before the bigger work starts.
Can you help if we are not a client yet?
We will do what we can, billed at our hourly rate, though we work faster in environments we already know. Having us look after your systems beforehand means logs, backups and documentation are ready when you need them.
Can you help us prepare an incident plan?
Yes. A one-page plan that says who to call, which systems to protect first and how to reach staff when email is down is one of the most useful documents a small business can have, and we help you write and rehearse it.
Other ways we help
Managed IT
One monthly price per person for support, security, updates and backups. Your outsourced IT team.
Managed IT
IT support
Remote and onsite help when you need it, billed by the hour. No plan, no contract.
IT support
Cyber security
Practical protection against scams, ransomware and account takeover, set up and kept current.
Cyber security