← All guides

Playbook

We think we got phished

3 min read

Someone clicked a link, opened an attachment, or typed a password into a page that looked real. Act calmly and quickly. The first hour matters most.

In the first hour

1. Keep the email. Do not delete it or forward it around the office. Take a screenshot.
2. If a file was opened or something installed, disconnect that computer from the network (unplug the cable, turn off Wi-Fi). Leave it powered on.
3. Change the password that was entered, using a different device. Change it anywhere else the same password is used.
4. Sign out everywhere. In Microsoft 365 or Google, sign the account out of all sessions, and confirm MFA is on.
5. Call your IT support. Ask them to check the mailbox for new forwarding rules and unusual sign-ins. Attackers often add a hidden rule to read or redirect mail.
6. Call your cyber insurer's claims line before hiring anyone. Many policies require you to use their approved responders.

Later the same day

• Write down a timeline: who clicked, when, what they saw, and what was done.
• Warn staff about the email so no one else clicks it.
• If the account could reach patient information, treat it as a possible breach and follow the breach steps.

What not to do

• Do not blame the person who clicked. People who fear blame stop reporting.
• Do not pay anyone, or reply to the attacker.
• Do not wipe the computer before your IT support or insurer says so. It may hold evidence.

How to spot the next one →