Isolate, don't wipe
Disconnect affected systems from the network (pull the cable / disable Wi-Fi) but do not power off unless critical. Memory and running-process evidence is lost on shutdown. Your future forensic investigation depends on this.
Switch to out-of-band communication
Assume the attacker is reading your email. Use personal phones / Signal / in-person meetings for internal incident comms until you've confirmed the attacker is out. No email, no company chat, no shared documents.
Engage legal counsel FIRST
Before talking to anyone outside the core response team — loop in an attorney (ideally one familiar with cyber breach response). Legal privilege protects investigation communications. Your IR firm, your insurance claim, your regulatory filings all run through counsel.
Notify your cyber insurance carrier
Most policies require notification within a short window (often 24–72 hours) to preserve coverage. They'll also assign a panel IR firm — don't hire one until you've checked. Wrong firm = out-of-pocket costs.
Engage an incident response firm
If you don't have one on retainer, your insurance will assign one. They'll triage scope, coordinate forensics, and guide regulatory timelines. Trying to DIY a major breach is where things go permanently wrong.
Preserve evidence
No cleanup. No patching. No re-imaging. Nothing until forensics collects images and logs. Document decisions in a running log (date, time, decision, decider). This log becomes critical in legal proceedings.
Activate the IR plan. Don't improvise.
If you have a documented incident response plan, run it. If you don't, that's tomorrow's problem — today, work with counsel and the IR firm. Avoid ad-hoc decisions at the executive level.