What To Do If Your Business Is Hacked

Quick Answer: What Should You Do Immediately If Your Small Business Is Hacked

‍
Contain the breach by stopping use of compromised systems, disconnecting from the internet, and changing passwords, then contact IT staff, your processor, authorities, and a forensic investigator.

• Cyber attacks on small businesses rose 300% in 2012 versus the prior year, per Symantec.
• Immediately revert to telephone dial-out terminals and pull your shopping cart offline if compromised.
• Disconnect the internet by unplugging your modem or Ethernet cable to stop data loss.
• Acting proactively right after a breach has, in some cases, led card brands to reduce penalties.

‍

If your organization is compromised, you’re not powerless.

Small businesses are the target of many compromises. In fact, according to Symantec, cyber attacks on small businesses rose 300% in 2012 from the previous year.

Many business owners call us in a panic after learning their retail location or website has been hacked. Terrified, these merchants literally have no idea what to do.

But you CAN do something after a breach! Even though you’re not a security expert, there are a few To Do’s that might actually help reduce any compromise penalties you may encounter. I personally know of a few instances in which the card brands (Visa, MasterCard, etc.) reduced compromise penalties because a hacked merchant acted proactively immediately following the breach.‍

See also: What To Do If Your Business is Hacked, Step-by-Step‍

In the video below, I give some guidance on what you personally can do if you suspect a breach.

‍Recap: what to do when you are hacked (or suspect you’ve been hacked)

• Contain the breach to minimize its impact
  • Stop use of all compromised systems
  • Revert to telephone dial out terminals
  • Pull your online shopping cart offline
  • Disconnect the Internet. (If you are connected via modem, unplug the modem cable, if you are connected via Ethernet, unplug the Ethernet)
  • Change all passwords
• Contact appropriate parties
  • IT staff, developer, and/or hosting provider
  • Merchant processor
  • Local authorities
  • Lawyer
  • Request a forensic investigator