Incident Response Runbooks: What to Do in the First 24 Hours After a Hack

The clock starts the moment a breach alert fires. Systems can be disabled, confidential data siphoned, and customer confidence dented long before a full investigation even begins. Those opening hours decide whether you stay ahead of the attacker or chase chaos.

This rapid runbook gives teams a clear, time-boxed path for hack recovery: triage, containment, malware cleanup steps, communications and evidence preservation. By following a structured sequence, you maintain business focus, meet legal and insurer expectations and keep decision-makers calm.

Immediate Triage: First 30–60 Minutes

Fast scoping tells you how big the problem is, who needs to be involved and which systems to lock down first.

Quick Incident Identification

Record how the incident surfaced: SIEM alert, user ticket or third-party notification. Note the exact time, initial symptoms and all affected assets. Classify severity based on business impact, then trigger the escalation playbook.

Rapid Scope Mapping

List compromised user accounts, IP addresses, hosts and key services such as email, payroll or payment processing. Rank them by potential revenue, regulatory or customer consequences.

Immediate Roles and Escalation

Activate the incident lead plus IT, security, legal and communications owners. If you retain an external forensics partner, page them now. Brief executives with a two-sentence status and set the next update checkpoint. Clear, early communication underpins every successful hack recovery.

Contain and Isolate: Actions to Stop Ongoing Damage

Once the scope is sketched, stop the bleeding while keeping evidence intact.

Short-Term Containment

Isolate infected hosts on a quarantine VLAN rather than powering them off. Suspend or reset compromised accounts, revoke active tokens and rotate privileged credentials. For ransomware, disconnect backup repositories to prevent secondary encryption.

Network Controls

Block malicious IPs and command-and-control domains at firewalls and intrusion systems. Apply temporary rate-limits or geo-blocks to exposed services until they are verified safe.

Operational Cautions

Avoid mass reboots or hurried re-images before capturing volatile data; overwriting evidence can hinder later insurer or regulator reviews.

Preserve Evidence, Legal & Insurance Notification

A calm, forensic-ready mindset protects you from legal, regulatory and financial surprises.

Evidence Preservation Steps

Capture full-disk images, memory dumps, and log exports before making changes. Keep a chain-of-custody log detailing who collected each artefact and when. Store copies in write-once locations to prevent tampering.

Legal, Privacy & Insurance Considerations

Contact legal counsel to assess breach-notification obligations and deadlines. Alert your cyber insurer early; many policies require notice within 24 hours and specify evidence formats. Record every decision and approval for audit.

Eradicate Malware: Practical Malware Cleanup Steps

With systems contained and evidence secured, remove the attacker’s foothold.

Malware Cleanup Steps

1. Correlate Indicators of Compromise (hashes, IPs, file paths) against all hosts to locate infections.
2. Follow vendor-specific removal instructions for known malware. If malware is unfamiliar or shows persistence techniques, escalate to specialist forensics.
3. When system integrity is doubtful, rebuild from known-good images instead of in-place cleaning.
4. Validate cleanliness with at least two tools (endpoint scanner and network telemetry) before reconnecting hosts.

Validation & Hardening Post-Eradication

Patch exploited services, enforce MFA, rotate all credentials and delete dormant admin accounts. Increase log retention, deploy honeypots where feasible and tune alerts to catch the same attack pattern in minutes, not hours.

Restore Services Safely

Business must resume, but only on trusted foundations.

Prioritised Restore Sequence

Recover systems in business-value order: identity stores, customer-facing portals, internal collaboration tools. Verify backups offline, then stage restores into a clean environment. Where compromise is suspected within an image, rebuild instead (See /blog/backup-best-practices).

Post-Restore Validation

Reissue credentials, test user journeys and transaction flows, then monitor aggressively for anomalies for at least a fortnight. Document sign-off from each system owner before declaring full production status.

Communication Plan: Who to Tell, When and How

Clear, timely messaging limits speculation and regulatory risk.

Internal Communications

Give executives a concise impact summary, current containment status and next check-in time. Provide staff with do-and-don’t guidance: which systems are offline, password-reset rules and approved sharing channels.

External Notifications

Inform customers with factual, calm statements: what happened, what you’re doing and the expected next steps. Coordinate wording with legal for any regulator reports, ensuring deadlines are met. Alert critical partners or payment gateways so they can reinforce their own defences.

Media/PR Considerations

Prepare a short holding statement and name a single spokesperson. Commit to scheduled updates rather than ad-hoc comments, and never speculate on root cause until investigations confirm.

Communication Templates & Channels

Keep pre-written email, portal banner and social-media templates stored with the plan for one-click deployment. Maintain an off-network copy so you’re not stranded if mail servers are affected. A rehearsed communication plan saves precious time.

Post-Incident Review and Next Controls

Turn hard-won lessons into stronger defences.

Rapid After-Action (within 7 days)

Reconstruct a full timeline, evidence summary and decision log. Identify the root cause, not just symptoms, and map each finding to a control gap.

Remediation Roadmap

Rank fixes by risk and effort–patch high-priority systems, improve network segmentation and tighten identity management. Assign owners, deadlines and budget.

Reporting & Compliance

Produce a concise incident report for leadership, insurers and, if needed, regulators, highlighting exactly what you achieved in the first 24 hours.

When Every Minute Counts, Structure Wins

Rapid triage, decisive containment, evidence preservation, structured malware cleanup steps, safe restoration and a disciplined communication plan form a proven 24-hour rhythm for hack recovery. Follow this runbook to slash downtime, protect customer data and preserve insurer or regulator confidence.

At Crazy Domains, we help reduce recovery risk by keeping your domains, hosting, backups and DNS under one secure, well-monitored roof. When incidents strike, our infrastructure and support let you isolate, restore and communicate faster with confidence.

Cut recovery time before the next alert hits. Move your domains and hosting to Crazy Domains today! Sign up now.