What to Do If Your Business Gets Hacked
7 min
No business, large or small, is immune to cyberattacks, and in Ireland, they’re alarmingly common. According to the Hiscox Cyber Readiness Report 2024, Irish businesses experience an average of 58 cyberattacks per year, with 74% reporting an increase in incidents. Over half of organisations were targeted last year, and nearly 90% have faced financial loss or disruption from a breach in the past five years.
With threats such as data breaches, ransomware, and phishing on the rise, preparation is crucial. In this blog, we outline six key steps to take if your business falls victim to a cyberattack, providing practical advice to help you respond effectively and minimise the damage.
Step 1: Detect, Contain and Preserve Evidence
As soon as you suspect a hack, your immediate goals should be to detect what has happened, contain the incident (stop further damage), and preserve evidence (for legal, regulatory and insurance purposes).
WHY IS THIS CRITICAL?
Time is of the essence. The longer attackers remain undetected, the more data they may access, and the greater the reputational, regulatory and direct financial damage. Grant Thornton's publication, "The Economic Cost of Cybercrime," stresses the importance of detection and response capabilities, regardless of whether a breach occurs.
Additionally, preserving evidence ensures that you have a clear chain of events for regulatory obligations (e.g., notification under the GDPR), insurance claims, and potential legal action.
WHAT YOU SHOULD DO
- Isolate affected systems immediately - disconnect from the network or shut down compromised servers to contain the breach.
- Alert your IT team or external incident response experts right away.
- Preserve all logs, timestamps, and forensic data; don’t delete or overwrite evidence.
- Document every step you take, including when the breach was discovered, actions taken, and who was notified.
Step 2: Understand The Scope of the Breach
Once contained, you need to evaluate what was compromised, who was affected, and the extent of the impact. This includes systems, data, business operations, customers, suppliers, and reputational risk.
WHY DO YOU NEED TO DO THIS?
Although it may be challenging to work out which systems or data have been breached in the moment, knowing the full scope informs the rest of your response: regulatory reporting, customer notifications, potential legal liability, and business continuity planning.
Understanding the impact also helps you prioritise recovery (which systems to restore first, what data to recover, which customers/suppliers to inform).
WHAT TO FOCUS ON
- Identify what data was accessed or stolen - personal, financial, intellectual property, or customer/supplier information.
- Determine if sensitive data (such as health, payment, or personal identifiers) is affected, as this may require notification to the DPC.
- Assess which business operations are disrupted, from offline systems to halted services or supply chain issues.
- Analyse how the breach occurred - phishing, ransomware, insider error, or third-party failure.
- Evaluate broader impacts on customer trust, reputation, supplier relations, and regulatory compliance (e.g., GDPR).
Step 3: Notify The Right Stakeholders
Once you understand the scope, you must inform the relevant stakeholders: internal teams, regulators, customers/clients, partners, and insurers. Speed and transparency are essential.
WHY THIS IS ESSENTIAL
Failing to notify the Data Protection Commissioner or affected individuals when you have a reportable breach could lead to regulatory fines under GDPR and other regulations. Also, informing customers and suppliers early supports trust and may reduce reputational damage. This is important given the statistics above, where reputation harm was cited by 65% of organisations as a significant risk from cyber-attack.
WHO TO NOTIFY
- Notify key internal teams - management, IT/security, legal, HR, and communications.
- Inform regulators where required. In Ireland, the DPC must be notified if personal data is affected, and the NCSC if critical infrastructure is compromised.
- Communicate with customers and clients if their data is impacted, explaining what happened and recommending the next steps.
- Alert suppliers or partners if shared systems or the supply chain are affected.
- Contact your cyber insurance provider promptly, as timing can affect coverage.
- Report criminal activity, such as ransomware or extortion, to the Gardaí or relevant cybercrime units.
Step 4: Eradicate The Threat and Recover Your Systems
After containment, you need to remove the presence of the threat, clean up systems, and restore operations safely. Recovery is not just about “turning computers back on”; it’s about rebuilding trust, ensuring vulnerabilities are addressed, and validating that systems are secure.
WHY THIS STAGE IS VITAL
If the attacker is still present or back doors remain, you risk repeat attacks. Research emphasises that detection and reaction are more important than whether you are attacked. Also, restoring operations quickly but securely is key to business continuity and avoiding further financial loss and reputation damage.
RECOVERY BEST-PRACTICES
- Remove the attacker’s access by changing credentials, disabling compromised accounts, removing malware, and rebuilding affected systems if needed.
- Patch and update all systems, fixing exploited vulnerabilities and hardening security to prevent recurrence.
- Restore operations from verified, clean backups, ensuring data integrity, especially after ransomware incidents.
- Test thoroughly before resuming normal operations to confirm systems, data, and access controls are secure.
- Strengthen monitoring and logging post-recovery to detect any lingering or renewed threats.
- Review your business continuity and disaster recovery plans to capture lessons learned and improve resilience.
Step 5: Communicate Clearly and Rebuild Trust
A cyber-incident is not only an IT issue; it’s a trust issue. Customers, suppliers, employees and partners will want to know how you responded, what you are doing now, and how you will prevent it from happening again. Transparent communication can help mitigate reputational damage.
WHY THIS MATTERS
In Hiscox’s study, nearly half of the businesses surveyed reported reputational damage after a cyber-attack, and many found it more challenging to win new customers. Failure to communicate appropriately can lead to customer attrition, supplier concerns, and media scrutiny.
COMMUNICATION BEST-PRACTICES
- Be transparent about what happened, what data or systems were affected, and what steps are being taken.
- Advise affected parties on protective measures, such as changing passwords or monitoring for suspicious activity.
- Provide timelines and commit to regular updates as new information emerges.
- Demonstrate actions taken to secure systems and strengthen controls.
Step 6: Post-Incident Review, Learnings and Prevention
Once the immediate crisis is managed, the final (and arguably most valuable) step is to review the incident in depth, draw lessons, and apply changes so that you reduce the risk of future hacks. Prevention is always cheaper (and less stressful) than recovery.
WHY THIS IS CRUCIAL
Cyber risk is not going away, especially in Ireland, where attacks are rising. The research emphasises that being prepared, resilient and able to react matters more than simply preventing every attack.
By studying the incident, you can strengthen your resilience, improve your response, and protect your business.
KEY REVIEW-ACTIVITIES
- Conduct a full post-mortem to understand what happened, why, how it was detected, and what controls or dependencies failed.
- Update your incident response plan, clarifying roles, escalation, communications, and evidence preservation.
- Strengthen controls, including access management, patching, network segmentation, and employee training.
- Regularly monitor and test systems with vulnerability scans, penetration tests, and simulated attacks.
- Review supplier and third-party risks, as many breaches involve external partners.
- Audit backups and business continuity plans to ensure they are secure, tested, and recoverable.
Final Thoughts
If your business experiences a hack, acting promptly, methodically and transparently makes all the difference. The sequence we’ve laid out above, including how to detect & contain, scope & understand, notify, recover, communicate, review & prevent, will give you the best chance of emerging resilient and trusted.
With attacks rising, reputational stakes high, and financial losses mounting (for example, some Irish businesses paid ransoms averaging €700,000 last year), having a clear response plan in place is essential to protect your business and maintain customer trust.
---
As Ireland’s leading office solutions provider, we offer a wide range of essential office technology that businesses need. Open an account today or contact us at sales@codexltd.com for product recommendations or pricing!
RELATED ARTICLES:
