5.1Responding to an incident (hacked account, ransomware)
The essentials in 30 seconds
- Isolate without switching off: network cut (Wi-Fi off, cable unplugged), machine left powered on — shutting down destroys evidence.
- Alert without delay, then stop touching: IT/CISO first, never tinker alone with an incident.
- Never pay: no guarantee, funds crime — the way out is the offline backup (3.1).
Running mini-case — Karim and the morning when everything froze
Karim, an office employee in Algiers, opens an attached “invoice” one morning: his screen freezes, files are renamed with strange extensions, a message demands a ransom. Instead of switching off or paying, he turns off Wi-Fi, leaves the machine powered on, calls the IT contact and notes the time, the symptoms and his last click. This section tells the story of his first 10 minutes — and the thread continues in 5.2, 5.3, 5.4 and 5.5.
This same case returns in the lesson, the diagram, the script and the 48h challenge — and continues in 5.2, 5.3, 5.4 and 5.5.
1. The decisive first minutes
Hacked account, abnormal workstation behaviour, ransomware, fraud: the first minutes decide the scale of the damage. A good response limits it; a bad one (switching off, paying, tinkering) multiplies it. Karim succeeded because his quick-reaction card was ready before D-day.
Golden rule: under stress, you do not improvise, you execute the card. Doubt costs nothing (a false positive can be checked); silence or tinkering costs a lot.
2. Isolate without switching off, alert, stop touching
Isolate: cut the workstation off the network (Wi-Fi off, cable unplugged) to stop the spread — but switch nothing off (RAM holds evidence useful for analysis). Alert IT/CISO and management without delay; stop touching the machine. Karim isolates, calls, then steps away from the keyboard.
Hacked account case: password changed from another clean device + sign-out of all sessions + check of mailbox forwarding rules (attackers often add a discreet redirection there).
3. Never pay, preserve evidence
Never pay the ransom: no guarantee of recovery, funds crime, marks you as a “good payer” inviting re-attack. The real way out is the offline backup (3.1) and professionals. Karim refuses to pay despite the countdown pressure on screen.
Preserve evidence: screenshots, original email kept, times noted. This file will serve the analysis, the complaint and the insurance claim. Also warn colleagues if a trapped message is still circulating.
🔎 Concrete example — Karim's first 10 minutes
What Karim does, minute by minute.
Minutes 0-2: frozen screen + renamed files -> Wi-Fi OFF, cable unplugged, machine LEFT powered on.
Minutes 2-5: call to the IT contact (number noted in advance): “suspicious workstation, isolated, I am not touching anything”.
Minutes 5-10: note time + symptoms + last click, capture the ransom message, warn 2 exposed colleagues.
-> Account: password changed FROM the phone + sessions signed out + forwarding rules checked.Reading: each minute has its move, no tinkering.
Lesson: the card is written before the incident, not during it.
Section vocabulary
- Security incident
- Any event that compromises (or seems to compromise) security: hacked account, abnormal workstation, ransomware, fraud.
Simple example: Karim sees his files renamed with strange extensions: he treats it as an incident.
What it is not: “it is only a bug, I will wait for it to pass”.
Reflex: when in doubt, isolate and alert — a false positive costs nothing.
- Isolate
- Cut the affected machine off the network WITHOUT switching it off: stop the spread while preserving evidence.
Simple example: Karim turns off Wi-Fi and unplugs the cable, screen left powered on.
What it is not: switching the workstation off or continuing to work on it.
Reflex: network cut first, questions afterwards.
- Do not switch off
- Switching off destroys evidence in RAM useful for analysis.
Simple example: Karim's machine stays powered on until IT arrives.
What it is not: pressing the power button “to stop the virus”.
Reflex: unless IT instructs otherwise, never switch off a suspicious workstation.
- Never pay
- A ransom guarantees nothing, funds crime and attracts re-attack.
Simple example: Karim refuses to pay despite the countdown displayed.
What it is not: paying quickly “to recover vital files”.
Reflex: ransom = backups (3.1) + professionals, never payment.
- Preserve evidence
- Captures, original email, times: the file for analysis, the complaint and insurance.
Simple example: Karim photographs the message and keeps the original trapped email.
What it is not: deleting the trapped email “to clean up”.
Reflex: note time, symptoms, last click — right away.
In practice — Your personal quick-reaction card (prepare BEFORE)
- Write your card in 5 lines: 1) I isolate (network cut, machine left on); 2) I alert [IT contact: name/number]; 3) I stop touching the machine; 4) I note what I saw (time, symptoms, last click); 5) I warn colleagues if a trapped message is circulating.
- Fill in your real IT/contact person — now, not on D-day.
- Hacked account case (personal or reachable work account): immediate password change FROM ANOTHER DEVICE + sign-out of all sessions + check of mailbox forwarding rules.
- Print or save the card where you will find it under stress — that is the whole point.
Ready-to-say script — alert IT in 1 min
“Hello, this is Karim: suspicious workstation, I have isolated it from the network without switching it off and I am not touching anything. Symptoms: frozen screen and renamed files since [time], after opening an attachment [email subject]. I will send you screenshots and I remain reachable on my phone.”
Say on the phone to the IT/CISO contact, then send screenshots + original email without forwarding it to other colleagues.
Copy-paste template — incident quick-reaction card
INCIDENT — QUICK-REACTION CARD (complete BEFORE)
1) I ISOLATE: Wi-Fi OFF + cable unplugged, machine LEFT powered on.
2) I ALERT: IT/CISO [name + number]: _______________ | Management: _______________
3) I STOP touching the machine.
4) I NOTE: time ___ | symptoms ___ | last click ___ | screenshots: YES/NO
5) I WARN exposed colleagues (without forwarding the trap).
HACKED ACCOUNT: password changed FROM another device + sessions signed out + forwarding rules checked.Solo / small office
Karim alone without internal IT: card with provider + management contact, workstation isolated and moved aside pending intervention.
Very small business / tight budget
Card displayed next to each workstation + IT contact written in marker: no costly tool, just the reachable number and the 5 lines.
SME in Algiers
Karim notes the internal contact and the management to warn in Algiers: no invented emergency number — the internal channel comes first, official platforms next (5.2).
New team
Each member fills in their card then a 5-minute dry run: who calls whom, with what words, without touching the machine.
✓ Best practices
- Isolate the workstation from the network without switching it off.
- Prepare your quick-reaction card (real IT contact) BEFORE the incident.
- For a hacked account, change the password from a clean device.
✗ Common pitfalls
- Switching the machine off (destroys evidence).
- Paying the ransom (no guarantee, funds crime).
- Tinkering alone instead of alerting the CISO/IT.
Key takeaways
- Isolate without switching off, alert immediately, stop touching: the triad of the first minutes.
- NEVER pay the ransom: backups (3.1) and professionals are the way out.
- A hacked account: password changed from a clean device + sessions signed out + forwarding rules checked.
- The quick-reaction card is prepared before the incident — under stress, you no longer think, you execute.
48h challenge — apply tomorrow
Write your 5-line quick-reaction card with the real IT/CISO contact and display it next to your workstation: can you raise the alarm in under 5 minutes?
- I can quote the triad: isolate, alert, stop touching.
- My quick-reaction card is written with the real IT contact.
- I know why we do not switch off and never pay.
Frequently asked questions
How do I know if my workstation is compromised?
Classic signals: sudden slowness, abnormal windows/redirects, passwords rejected, emails sent without your knowledge, files renamed with strange extensions (ransomware). When in doubt: isolate and alert — a false positive costs nothing.
Why not pay, if the data is vital?
Beyond ethics: many victims never recover everything, payment invites re-attack, and sanctions target certain payments. The real life insurance is the offline backup from 3.1 — it must be set up now.
Karim's workstation displays a ransom message. First reflex?