When Something Goes Wrong

Every business that uses a computer will eventually have a bad day. A laptop goes missing from a truck. The bookkeeper's mailbox starts sending invoices she did not write. A message on the shared drive says "your files are encrypted." The first hour decides whether it stays a bad day or becomes a bad month, and the people who handle it best are rarely the ones who know the most about computers. They are the ones with a list.

This lesson is that list. It follows the shape of the FTC's guide Data Breach Response: A Guide for Business, which has three parts: secure operations, fix vulnerabilities, notify the right parties. It adds the CISA and FBI ransomware guidance, the FBI's rules of thumb for fraudulent payments and the Idaho notice law. Prevention is in lessons 01 to 09. Lesson 11 turns the pieces into a written policy.

Signs of trouble

Few incidents announce themselves. Most start as something small that nobody could explain. Train everyone to report odd things fast and without blame; people who fear getting in trouble wait, and waiting is what costs money.

What someone notices	What it may mean	First move
A ransom note, renamed files, files that will not open	Ransomware	Disconnect that machine; phone the owner and IT provider
Customers say they got an invoice from you that you did not send	Hijacked email account	Change the password and sign out all sessions from a clean device; check forwarding rules
Sent-folder items nobody wrote, or rules that forward mail to an unknown address	Mailbox takeover	Same as above; report to the email provider
A vendor says your payment never arrived, or a new bank account was "confirmed" by email	Payment diversion (BEC)	Call the bank first, then the vendor on a number from your own records
A login alert or two-step prompt you did not start	Someone has the password	Deny the prompt; change the password; check recovery email and phone
Unknown admin accounts, new remote tools, antivirus switched off	Intruder in the network	Disconnect, call outside IT, preserve logs
A lost or stolen laptop, phone or USB drive	Possible data exposure	Remote lock or wipe if set up; change passwords; note what was on it
A card terminal that looks changed, or a processor alert about fraud at your location	Skimmer or point-of-sale compromise	Stop using the terminal; call the processor
A caller who knows too much and pushes for urgent action	Social engineering in progress	Hang up; call back on a number you already have

Isolate or shut down

This question causes more arguments than any other. The two main government sources agree on the answer. CISA's #StopRansomware guide says to determine which systems are affected and isolate them immediately; if several systems or subnets are affected, take the network offline at the switch. It says to power down only "if you are unable to disconnect them from the network," and warns that powering down loses volatile evidence such as data in memory. The FTC's guide says to take affected systems offline to stop data loss but to leave the machines on until forensic experts arrive.

In a small office that comes out like this:

• Pull the network cable from the affected computer or switch off its Wi-Fi. If you do not know which computers are affected, unplug the office's internet router and the switch. Work done on the internet is paused; data on other machines may be saved.
• Leave the computer on. Do not log in to it, do not delete anything and do not run cleanup tools.
• If it is on a laptop and already encrypting files, and you cannot disconnect it, hold the power button. Write down that you did, and when.
• Phone people rather than email or chat while the attacker may be watching. CISA recommends out-of-band communications such as phone calls so attackers are not alerted.

The first hour

One person leads. In a small firm that is the owner, or the owner has named an office manager in the incident card. Everyone else follows. Write down times as you go, in a notebook or on paper, not on the affected computer.

1. Note the time you learned of the problem, who noticed and what they saw. Take photos of screens with a phone. Photos preserve ransom notes and error messages that can disappear.
2. Contain it. Disconnect the affected computers. Disable the suspect account or change its password from a different, clean device. If a mailbox is hijacked, sign out all sessions and check forwarding rules and recovery contacts.
3. Tell the owner and your outside IT provider by phone. If you have no provider, call your cyber insurer's breach hotline (many policies have one; the FTC suggests asking your agent whether the insurer offers a 24-hour hotline). The hotline can name a forensic firm, which often matters for coverage.
4. Money moved? Call the bank now. Ask for a recall of the transfer and ask what indemnification documents they need. Then file at ic3.gov with full transaction details.
5. Card data involved? Call the processor, using the number on the merchant statement.
6. Stop new damage. Change passwords for critical accounts (email, bank, payroll, accounting) from a clean device. Turn on two-step sign-in if it was off.
7. Keep staff informed with one short instruction: what not to touch, who to call, and what to say if a customer asks.

The first day

1. Bring in the professionals. Outside IT or a forensic firm should confirm what was affected, how the intruder got in and whether the access is closed. The FTC says to interview the people who discovered the breach, document the investigation and preserve all forensic evidence.
2. Find out what data was involved: customer names, card numbers, employee Social Security numbers, bank details. Idaho's notice duty turns on this, and so does the Safeguards Rule if it applies to you.
3. Check for stolen data. Modern ransomware often steals files before encrypting them. Ask whoever investigates whether data left the network.
4. Report to law enforcement. File at ic3.gov. The FTC says to contact local police immediately and, if they lack experience with data compromises, the FBI or the U.S. Secret Service. CISA's ransomware page lists CISA, the local FBI field office, IC3 and the local Secret Service field office as places to report.
5. Tell your insurer in writing. Policies set notice deadlines and some require approval before you hire help.
6. Remove any personal data that was posted by mistake on your site and ask search engines to stop archiving it, as the FTC guide advises.
7. Decide who speaks for the business. Name one point person for questions from customers, staff and reporters.

The first week

1. Restore carefully. CISA says to restore from offline, encrypted backups in order of critical services and to avoid reinfecting clean systems. Rebuild affected computers from a clean standard image, and reset passwords only after the environment is cleaned.
2. Close the hole. Patch the software that was exploited, remove unused remote-access tools, turn on two-step sign-in everywhere and review who has admin rights.
3. Check vendors. The FTC advises reviewing what personal information service providers can access, limiting it and verifying that claimed fixes work.
4. Decide on notice and send it (see below). Offer help to affected people.
5. Watch the accounts. Look at bank and card statements daily for a month. Keep the new password and device list.
6. Write down what happened and what it cost. You will need it for the insurer, for taxes and for the lessons-learned meeting.

Who to call, in order

Call	When	What to have ready
Outside IT provider or managed provider	Right away, by phone	Time noticed, affected machines, what you already did
Bank or payment processor	Any money moved or card data involved; immediately	Account numbers, transaction details, date and time
Cyber insurer's breach hotline or your agent	Same day; read policy notice terms	Policy number, summary of events
FBI IC3 (ic3.gov)	Any cyber-enabled fraud, regardless of amount; ransomware	Full transaction details, wallet or account numbers, emails with headers
Local FBI field office, or Secret Service field office	Ransomware, large losses, ongoing intrusion	Same as above
CISA (report.cisa.gov)	Optional report of ransomware or intrusion; CISA lists it as a place to report	Indicators, ransom note text
Local police	Stolen equipment, tampered terminals, mail theft (U.S. Postal Inspection Service for mail)	Serial numbers, photos
FTC (ReportFraud.ftc.gov); Safeguards Rule form if covered	Scams in your name; covered breaches of 500 or more consumers within 30 days	Description of data and affected count
Idaho Attorney General, Consumer Protection	Optional for businesses, required for public agencies	Copy of customer notice
Affected customers and employees	After you know what was exposed	The letter (below)

Evidence to keep

Evidence turns "we think" into "we know," and the insurer, the bank and the police will all ask. Keep it in a folder off the affected computers:

• Photos of ransom notes, error screens and odd emails (and the original emails with full headers).
• A timeline with times, names and actions, written as you go.
• Bank transaction records, wire confirmations and the fraudulent invoice.
• Logs that the email, cloud or firewall provider can export before they roll off.
• The affected devices themselves, powered as you found them, if forensics will be done. CISA says to take system images and memory captures of a sample of affected devices, which the forensic firm does.
• Copies of messages sent to customers and staff, and replies.

Ransomware: the decision facts

Nobody should decide on paying while the screen is flashing. Know the facts before it happens.

Things worth knowing before a demand arrives:

• Law enforcement position. The FBI does not support paying. It asks victims to report to a field office or at ic3.gov. CISA suggests asking federal law enforcement about available decryptors.
• Sanctions. The Treasury Department's OFAC advisory of 21 September 2021 says civil sanctions penalties can apply on a strict liability basis, even if a payer did not know a recipient was sanctioned. It treats a prompt, complete, self-initiated report to law enforcement as a significant mitigating factor, along with cooperation, offline backups, response plans and training. License requests to pay are reviewed with a presumption of denial.
• Numbers. The FBI's 2025 IC3 report counted 3,611 ransomware complaints and about $32.3 million in reported losses. The report says the figure does not usually include lost business, time, wages, files, equipment or third-party remediation, so it understates real cost. Verizon's 2026 page also says payouts are shrinking and businesses are often choosing not to pay. A summary of Verizon's 2025 report reported a median ransom of $115,000 and that 64 percent of victims did not pay.
• Backups decide the outcome. CISA recommends offline, encrypted backups of critical data, tested regularly. Cloud storage with object lock or version history can serve the same purpose. A shop with a clean, current copy is in a very different position from one without.
• Insurance. If you carry cyber insurance, call the hotline before any negotiation or payment. Many policies cover forensic and recovery costs, and some insurers manage negotiations. The FTC cyber insurance page suggests asking your agent whether coverage is first-party, third-party or both, and whether a 24-hour hotline exists.

Fraudulent payments and the wire recall

Business email compromise (BEC) is a fake or hijacked message that gets someone to send money to the wrong account. The FBI's IC3 recorded 24,768 BEC complaints in 2025, with reported losses of $3,046,598,558, second only to investment fraud. Lesson 08 shows how to stop it. This section is for the day after.

The IC3 Recovery Asset Team runs the Financial Fraud Kill Chain, a process that works with banks and FBI field offices to freeze fraudulent transfers. In 2025 it handled 3,900 incidents, covering $1,163,919,846 of attempted theft, and froze $679,013,183, a 58 percent success rate. Those numbers were not luck: the report stresses speed. Its guidance, in plain words:

1. The moment you discover a fraudulent transfer, call your bank or financial institution and ask for a recall of the funds. Ask what documents the bank wants for indemnification.
2. File a complaint at ic3.gov regardless of the amount, with full transaction details.
3. Know your bank's policy beforehand. The report notes that institutions differ on what help they offer.
4. Do not wait for the vendor to confirm. Treat it as lost until the bank says otherwise.

Telling employees and customers

Tell the people who were affected as soon as you know what happened and how to help them. The FTC guide recommends coordinating timing with law enforcement, naming one point person, and using letters, a website page, a toll-free number or press notices as needed. When Social Security numbers or financial data were exposed, it suggests considering at least a year of free credit monitoring or other support. A good letter, in the FTC's model, has six parts:

1. What happened.
2. What information was involved.
3. What we are doing.
4. What you can do (free fraud alert, credit freeze, review credit reports).
5. Other important information.
6. For more information, with a name and number.

Be accurate and plain. Do not hide details that help people protect themselves, and do not guess about what you do not know. Direct people to IdentityTheft.gov for recovery steps. If it was employee data, tell staff first, in person if possible, and explain what you are doing for them.

Idaho breach notice basics

Idaho's law is in Idaho Code 28-51-104 to 28-51-107. In plain terms:

• Who it covers. A city, county or state agency, an individual or a commercial entity that conducts business in Idaho and owns or licenses computerized data that includes personal information about an Idaho resident. A commercial entity is any legal entity, for-profit or not, including a corporation, partnership, LLC, trust or association.
• What is personal information. A resident's first name or initial and last name combined with an unencrypted Social Security number, driver's license or Idaho ID number, or a financial account, credit or debit card number with any required security or access code. Publicly available government records are excluded.
• What is a breach. Illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality or integrity of personal information. A good-faith acquisition by an employee or agent for the business's purposes is not a breach if the information is not used or shared without authorization.
• What to do. When you become aware of a breach, conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused. If misuse has occurred or is reasonably likely, give notice as soon as possible to the affected Idaho resident. The statute says notice "must be made in the most expedient time possible and without unreasonable delay," consistent with the legitimate needs of law enforcement and with measures needed to determine the scope, identify those affected and restore the system. It sets no fixed number of days.
• Law enforcement delay. Notice may be delayed if law enforcement advises that it would impede a criminal investigation, then must follow promptly.
• If you hold data for someone else. A business that maintains but does not own or license the data must notify the owner or licensee immediately after discovering a breach if misuse has occurred or is reasonably likely, and must cooperate.
• The attorney general. The 24-hour notice to the Idaho attorney general applies when an agency becomes aware of a breach. The attorney general's office says commercial entities may notify it but are not required to.
• Form of notice. Written (to the most recent address on record), telephone or electronic notice. Substitute notice (email, a conspicuous website posting and notice to major statewide media) is allowed when the cost would exceed $25,000, more than 50,000 residents must be notified or contact information is lacking.
• Your own procedures or a regulator's. Under 28-51-106, a business with its own notice procedures in an information security policy is treated as compliant if those procedures are consistent with the timing in 28-51-105 and it follows them. A business regulated by state or federal law is treated as compliant if it follows its regulator's breach procedures.
• Enforcement. The primary regulator, which for most businesses is the attorney general, may bring a civil action to compel compliance. An entity that intentionally fails to give required notice may be fined up to $25,000 per breach of the security of the system.

Residents of other states are covered by their own states' laws, and the FTC guide says every state, D.C., Puerto Rico and the U.S. Virgin Islands has a breach notification law, so a business with out-of-state customers must check each one. Some businesses answer to federal rules too: the FTC Safeguards Rule's 30-day notice to the FTC for covered non-bank financial businesses (see lesson 09) and health breach rules for medical offices. Module 73 covers these frameworks at greater depth.

Restore and learn

Restoring is not finished when the screens come back. Check that the entry point is closed, that no extra accounts or remote tools remain and that the restored backup does not carry the malware. Test the important systems with the people who use them. Run on the changed passwords for a month.

Hold a short, blame-free review within two weeks, with the owner, office staff and outside IT. Ask what first told us something was wrong, how long until we acted, what slowed us down, what cost the most and which one change would have helped most. Write it on one page, assign each fix to a person with a date, and fold it into your policy (lesson 11).

Sample one-page incident card

Print it, fill in the blanks, tape it by the front desk and save a photo in the owner's and office manager's phones. Do not store the only copy on a computer that might be down.

INCIDENT CARD for _______________ (business name)
1. Stop	Unplug the network cable and turn off Wi-Fi on the affected computer. Leave it on. Do not delete or clean anything.
2. Phone, do not email	Owner: ______________   Office manager: ______________   Outside IT: ______________ (24 hours: ______________)
3. Money moved?	Bank fraud line: ______________   Ask for a recall. Then ic3.gov.
4. Cards involved?	Processor: ______________ (number on merchant statement)
5. Insurer	Breach hotline: ______________   Policy no.: ______________
6. Write it down	Time noticed ______ Who ______ What they saw ______ . Photo the screen.
7. Accounts	From a clean device change passwords for email, bank, payroll, accounting. Sign out all sessions.
8. Report	ic3.gov; local FBI field office for ransomware; local police for theft. FTC: ReportFraud.ftc.gov
9. Customers and staff	One spokesperson: ______________ . No guesses, no blame.
10. Do not	Pay anyone, reply to the attacker or use the affected email until the owner decides with IT and the insurer.

Who does what

Task	Owner	Office staff	Outside IT provider
Declare an incident and lead	Yes, or named deputy	Supports; logs times	Advises
Disconnect and preserve devices	Approves	Does the unplugging, photographs screens	Takes images, investigates
Call bank, processor, insurer	Authorizes	Makes the calls with the card in hand	Not applicable
Reports to IC3, police, FTC	Signs off	Files with details	Supplies technical indicators
Notice to customers and employees	Approves letter, signs	Prepares mailing, answers phone	Helps determine who was affected
Restore and harden	Funds	Checks business function	Rebuilds, restores, patches
Review and update the plan	Chairs	Writes it up	Contributes

Questions and answers

Should we turn off Wi-Fi or unplug the router?

If you cannot tell which machines are affected, yes. Unplugging the router or switch cuts the spread across the office. CISA describes taking the network offline at the switch. Remember that you also cut your own access to cloud services, so use phones for calls.

Do we call the police or the FBI?

Both are reasonable. File at ic3.gov for any cyber-enabled crime. Call local police for stolen devices or tampered terminals. The FTC guide says to contact local police first and the FBI or Secret Service if the police have no data-compromise experience.

Will law enforcement take over our computers?

Usually the hands-on examination is done by your forensic firm. IC3 collects and analyzes reports and refers them to field offices. Keep the devices as evidence if a forensic firm or investigator asks.

A single employee's mailbox was hijacked. Do we have to notify customers?

It depends on what the mailbox held. Idaho's duty arises when personal information (name plus an unencrypted Social Security, license or financial account number) was compromised and misuse occurred or is reasonably likely. Have the investigator check what was in the mailbox and whether messages were opened or forwarded.

What if our data was encrypted before it was taken?

Idaho's definition concerns unencrypted data, and the Safeguards Rule's notification event concerns unencrypted customer information, though it treats information as unencrypted if the key was accessed by an unauthorized person. Encryption helps most when the key was not exposed.

How do we know it is really over?

Your IT provider should confirm that the entry point is closed, that unknown accounts and remote tools are gone, and that logs show no further access. Plan on watching for a month.

Should we offer credit monitoring?

If Social Security numbers or financial data were exposed, the FTC suggests considering at least a year of free credit monitoring. If only emails were exposed, a warning about phishing and fake invoices does more.

Our vendor was breached, not us. What now?

Ask for written details: what data, which customers, what they are doing. Idaho's statute puts the duty on the entity that owns or licenses the data, and requires a holder that does not own it to notify the owner immediately. Check your contract, and ask the vendor what it will do. Lesson 04 lists vendor questions to ask before signing.

Hard questions

Isn't "do not pay" easy to say when it is not your business on the line?

Yes, and the FBI's position is a recommendation, not a prohibition. The legal risk is real in particular cases (the OFAC advisory on sanctions), and the practical risk is that payment buys nothing. For a small shop with no usable backups and a demand it can afford, the pressure to pay is strong. The best answer is to be in a different position beforehand: a tested offline copy and a plan. If you are weighing payment anyway, do it through your insurer and law enforcement, not alone.

Why call the insurer before anyone else if I need help now?

You do not wait on the insurer to disconnect a computer or call the bank. You do call the hotline early, the same morning, because many policies set notice times and approved vendors, and the hotline's forensic partners are often pre-arranged. The FTC suggests asking your agent in advance whether the insurer runs a 24-hour hotline.

Doesn't reporting just bring more trouble?

The opposite is the better bet. The OFAC advisory treats a prompt, complete report to law enforcement as a mitigating factor, IC3 can only help freeze money if it hears about the loss, and the Recovery Asset Team stresses speed. The penalty in Idaho's statute is aimed at intentional failure to give required notice: up to $25,000 per breach.

If we notify and customers panic, haven't we made it worse?

Clear, honest notice with concrete steps lowers the harm. The FTC guide says to be accurate, not to withhold details that help people protect themselves and to publish answers to likely questions. Silence tends to come out later and looks worse.

Our "IT person" is a family member who does this on the side. Is that enough?

For setting up accounts and updates it can be. For an incident, you may need a forensic firm that can examine devices and preserve evidence, and your insurer's hotline can name one. Decide now who you would call, not on the day.