Attackers don't wait for you to finish your coffee. According to CrowdStrike's 2026 Global Threat Report, criminals in 2025 needed an average of 29 minutes to move from the first compromised system further into the network. In one investigated intrusion, data theft began within four minutes. They also choose the moment themselves. Sophos found in its Active Adversary Report that 83% of ransomware in 2024 was deployed outside the victim's local office hours.
So the first four hours revolve around one question. How do you stop it from getting bigger?
Take infected laptops, workstations and servers off the network. Taking them off the network literally means: unplug the cable, turn off Wi-Fi and disconnect VPN connections. The Dutch NCSC gives the same advice for ransomware: isolate infected networks, computers and devices and secure available backups as quickly as possible.
What you don't do is switch the device off. The systems' memory may hold traces of the attack (running processes, open connections to the attacker's server), and those disappear as soon as the power goes.
If it's ransomware, check your backups straight away. Is the backup drive or NAS on the same network? Then disconnect it first. Attackers deliberately go after backups, because a company without a working backup pays faster. How to prepare your business for a ransomware attack is covered in our blog on what to do in a ransomware attack.
Keep communicating and record actions and events.
Changing the existing password alone is no longer enough. If an attacker has hijacked your account's session, they no longer need your password. In its guide to revoking access in Entra ID, Microsoft describes two actions for a compromised account: disable the account and then choose "Revoke sessions", so existing tokens become invalid. An access token that has already been issued remains valid for up to an hour by default. So plan for that.
Work through this list and start with admin accounts, because they open every other door:
Keep communicating and record actions and events.
Someone has to decide. Do you take the webshop offline? Do you halt production? Do you bring in an outside party, and who pays for it? Do you call the insurer? Those aren't choices a system administrator can make.
So set up a crisis team in the first hour. Two roles are enough to start: someone who decides (management or the owner) and someone who coordinates the technical side (your IT administrator or security partner). Bring in communications and legal advice as soon as it becomes clear how big it is.
Make two agreements for that team:
It's important to keep communicating at this point about what's going on and about every step you take, even if they're only small things.
Keep communicating and record actions and events.
The fire is somewhat contained. Now you want to know how it started, because as long as you don't know the way in, the attacker can come back through the same door. Isolating systems isn't a one-off task either. You may repeat the steps from hours 1-4 several times, especially if you later discover you hadn't yet mapped all affected systems.
You're looking for answers to four questions:
The answers may be in your log files: the Microsoft 365 sign-in logs and audit log, your firewall logs and the alerts from your antivirus or EDR. If you have your own security team, they can get to work on this. At most small and medium-sized businesses, an external security partner records what happened.
So the same applies here: don't switch off systems and don't delete data. Otherwise it's no longer possible to trace what happened.
Keep communicating and record actions and events.
The reporting obligation depends on this question. An encrypted file server holding only quotes is annoying. But a mailbox with payslips, passport copies or medical records turns it into a personal data breach.
Make a list. Which systems were affected? What kinds of data are on them and whose are they: employees, customers, patients? Were they encrypted? And did the attacker exfiltrate data or only encrypt it? Large outbound data transfers in the firewall logs or in OneDrive and SharePoint often answer that last question.
Not sure yet? Then write down what you do know and what is still open. With an incomplete picture you can already take the next step, and at least you'll have information to report.
Keep communicating and record actions and events.
Evidence is fragile. Log files can be overwritten automatically, and switching off systems or deleting files makes forensic investigation a lot harder.
This is what you keep:
Keep communicating and record actions and events.
You probably don't know everything yet by a long way, but with these steps you hopefully know enough to make the first notifications.
For most companies, two sets of rules determine whether and when you have to report.
The data breach notification obligation (GDPR). If personal data was affected, you report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), within 72 hours of discovering the breach. Still in doubt? According to the same NCSC page, you also report a loss of personal data if you're not sure whether it counts as a data breach.
The Cyber Security Act (Cyberbeveiligingswet). The Dutch implementation of NIS2 came into force on 15 August 2026. If you fall under it and the incident is significant, then according to the NCTV a fixed reporting schedule applies: an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after that incident notification. You report via the MijnNCSC reporting portal. That notification reaches both your CSIRT and the regulator.
Also file a police report. Digital detective Gina Doekhie puts it bluntly in an article by KVK (the Netherlands Chamber of Commerce): "Always file a report." The more information the police have, the more patterns they can recognize. For ransomware, businesses can file a report online with eHerkenning, or make an appointment via 0900-8844.
Keep communicating and record actions and events.
Your IT administrator keeps your systems running. A security specialist takes action in situations like this. They know where attackers leave traces and set up a forensic investigation that will stand up with the insurer. With their experience, a specialist can also better judge when restoring from backup is safe.
If you have cyber insurance, read the policy first (ideally before you end up in this situation). Some insurers work with a fixed list of specialists and only pay out if you go through them.
A specialist who arrives in hour 14 and discovers that a server was reinstalled in hour 2 can reconstruct very little. So call earlier if you can.
Keep communicating and record actions and events.
Your customers would rather hear it from you than through a phishing email sent in your name. So don't wait until you know everything.
A good first message contains four things:
Also say what you don't know yet. That feels uncomfortable, but it saves you from having to take something back later. It also makes you transparent, which often pays off more afterwards than you'd think. What we see in practice is that your reputation with customers and partners holds up better that way.
Do you supply companies that fall under the Cyber Security Act themselves? Then they need your information for their own notification. Call those customers personally.
And who do you call outside the company during a cyber incident? The first external stakeholders are your IT provider and, if you have one, your cyber insurer. The insurer often has an emergency number and its own conditions about who you're allowed to bring in. So call before you hire a party yourself.
Keep communicating and record actions and events.
The mistake we see most often is that incidents are noticed and escalated too late. That costs a lot of time, and time is exactly what you need when you're under fire from a cyberattack.
Below we list three more common mistakes.
It's tempting. Fix it yourself, tell nobody and hope it isn't too bad. But data breaches often come out anyway, for example because the attacker publishes the data or a customer reports fraud. Then on top of the incident you have a trust problem, and possibly a fine for reporting too late.
On ransom, the police are clear: preferably don't pay. Paying is no guarantee you'll get your data back and increases the chance that criminals carry on. If you did pay, or are considering it, do report that to the police.
This usually happens with the best of intentions. The laptop gets reinstalled so the employee can get back to work. The server gets restarted "to see if it works then".
That wipes out exactly the traces that show how the attacker got in. And without that entry point, you don't know whether the hole is closed. Make a copy first, clean up afterwards.
Sales emails a customer that nothing is wrong, while the owner tells a supplier that all data is encrypted. Two people, two different stories.
Agree within the crisis team who communicates externally and let everyone know who that is. Send one internal message to all employees: what's going on, what they should and shouldn't do, and who they can go to with questions. Make sure this happens through a secure channel.
Look again at hours 1 to 4 in this cyber incident plan. Almost everything there is about speed: isolating and revoking sessions, preferably within the hour. Combine that with the fact that most ransomware and other attacks are deployed outside office hours, and the urgency is clear.
That's what Managed Detection & Response (MDR) is for. At Peakproteqt, we collect signals 24/7 from your entire environment, from endpoints to stolen credentials, session hijacking and compromised mail accounts. When a threat is confirmed, our team steps in: isolating a device, or blocking an account and revoking its sessions. Those are the same actions as in hours 1 to 4, except they happen within minutes instead of hours.
Exactly how fast depends on the package. With MDR Premium, we respond to a detected threat within 15 minutes, with fully automated response and incident response support.
You notice the second benefit in hours 4 to 12. The log files you'd otherwise still have to export are already there. Your timeline starts at the first unusual signal, and that is usually earlier than the moment someone in the office noticed something.
MDR doesn't replace your own plan: the reporting obligation, communication with customers and management's decisions stay with you. What it does do is make the first hours a lot shorter. Of course, in a situation like this we also help with communication to customers and with the reporting obligation. So you're not on your own. On the MDR page you can see what is monitored in each package.
