Acting quickly can help limit the damage. If a device or account appears to be compromised, disconnecting it from the network may help prevent the issue from spreading.
Businesses should contact their IT provider immediately, avoid deleting evidence and follow their incident response procedures. Passwords may need to be reset, accounts secured and affected devices investigated before normal activity resumes.
