Cyber Incident Response: What to Do First.

Published: 16 September 2026  |  By AOLC

The moment you realise something is wrong — encrypted files, a ransom note on screen, a client calling to say their data appeared online — is not the moment to start figuring out what to do. Yet that is exactly where most South African businesses find themselves. The IT person is on leave, the backup status is uncertain, and nobody is sure whether to reboot the server or call the police.

This guide covers the first 24 to 72 hours after a cyber incident is discovered. It is not a substitute for a full incident response plan, but it will help you avoid the mistakes that turn a recoverable incident into a business-ending one. A skilled partner can help you make the best of a bad situation — but the actions you take before they arrive matter enormously.

The First Hour.

Speed matters, but panic-driven actions cause more damage than the attack itself. In the first 60 minutes, your goal is to stop the bleeding without destroying evidence.

• Isolate, don't reboot — Disconnect affected machines from the network (unplug Ethernet or disable Wi-Fi). Leave them powered on if safe. Rebooting can wipe memory that forensic investigators need.
• Identify the scope — Which systems are affected? Is encryption still spreading? Are cloud services (Microsoft 365, file shares) involved?
• Preserve logs — Export or screenshot firewall, email, and cloud audit logs before they rotate. These are often the only record of how the attacker entered.
• Activate your contact tree — Call your IT provider, internal decision-maker, and — if you have one — cyber insurer. Document the time of discovery and who reported it.
• Do not pay the ransom yet — Payment decisions should come after backup assessment, insurance review, and legal advice. Over 60% of SA businesses that pay still do not recover all their data.

Our POPIA Breach Playbook walks through these steps in checklist form — useful to print and keep off-network before you need it.

Hours 1–24: Containment and Preservation.

Once immediate isolation is done, the focus shifts to understanding what happened and preventing recurrence while preserving evidence for investigation and compliance.

Containment means stopping the attack from spreading further. This includes disabling compromised user accounts, blocking known malicious IP addresses at the firewall, and ensuring backups are disconnected from the production network so they cannot be encrypted too. If you use managed security monitoring, your SOC should already be engaged — confirm they have isolated affected endpoints.

Forensic preservation is the step most businesses skip — and the one they regret most. Before anyone reinstalls Windows or "cleans up" infected machines, a digital forensics engagement captures disk images, memory dumps, and log files with documented chain of custody. This evidence supports POPIA breach notification, cyber insurance claims, and potential legal action. Well-meaning staff who wipe machines to "fix" the problem often destroy the only proof of what data was accessed.

Backup assessment — Identify your most recent clean backup. When was it taken? Is it offline or immutable? Can you actually restore from it? Many businesses discover during an incident that their backups have been failing silently for months. Test a restore to an isolated environment before committing to recovery.

Hours 24–72: POPIA and Recovery.

Under the Protection of Personal Information Act (POPIA), if personal information of data subjects has been accessed or disclosed without authorisation, you must notify the Information Regulator and affected individuals as soon as reasonably possible after discovery. The Regulator expects notification within 72 hours where feasible — and demonstrating that you followed a documented process matters when they review your report.

During this window you should:

• Determine data impact — What personal information was involved? How many data subjects? Was data exfiltrated or only encrypted locally?
• Draft regulator notification — Use the Information Regulator's prescribed form. Your forensic report feeds directly into this.
• Begin recovery — Restore from clean backups to rebuilt or isolated infrastructure. Validate data integrity before reconnecting to production. See Ransomware Remediation for AOLC's six-phase recovery process.
• Notify affected parties — Plain-language communication to clients, staff, or customers whose data was involved. Avoid technical jargon; explain what happened, what you are doing, and what they should watch for.
• Engage your insurer — Most cyber policies require prompt notification. Forensic and remediation costs are often covered — but only if you follow the policy's incident reporting requirements.

Forensics vs Remediation: What You Need.

These are related but distinct services. Understanding the difference helps you engage the right help quickly.

Digital forensics answers "what happened?" — who accessed what, when, and how. The output is an evidence-backed timeline for regulators, insurers, and your board. You need this when personal data may have been breached, when you might claim insurance, or when you need to understand the attack path to prevent recurrence.

Ransomware remediation answers "how do we get back to work?" — containment, malware removal, backup restoration, and hardening. You need this when systems are encrypted or offline and the business cannot operate.

Most serious incidents require both, in sequence: preserve and investigate first, then remediate and recover. AOLC delivers both services and can coordinate with your existing IT provider, legal counsel, and insurer so you are not managing five vendors during a crisis.

After Recovery: Don't Stop at Restored.

Getting systems back online is not the finish line. Within two weeks of recovery, conduct a post-incident review:

• What was the root cause and entry point?
• Which controls failed — or were missing?
• Update your incident response plan with lessons learned.
• Run a tabletop exercise with the scenario you just lived through.
• Consider an Incident Response Retainer so the next event starts with a pre-signed agreement and guaranteed SLA.

South African businesses face rising ransomware and breach rates — but the organisations that recover fastest are not necessarily the ones with the biggest budgets. They are the ones that isolate calmly, preserve evidence, engage expert help early, and treat POPIA notification as a process rather than a panic.

← Back to Blog