Ransom screens, emails sent to all your clients from your mailbox, files that won’t open, a bank transfer gone to an unknown IBAN: when a cyberattack hits an office, the first instinct is to switch everything off or try to fix it yourself. These are almost always the wrong moves. This guide explains what to do after a cyberattack, in order, and is designed to be printed out and kept close at hand.
What is a cybersecurity incident?
A cybersecurity incident is an event that compromises the confidentiality, integrity or availability of data or systems: ransomware, a hacked email account, data theft, an infected computer, a bank transfer scam, but also a stolen laptop. Not every incident is serious, but every incident needs to be handled methodically.
You are not alone: in 2025 the Postal Police (Polizia Postale, Italy’s cybercrime police) handled over 51,000 cases and recorded more than 9,000 attacks against infrastructure, public bodies, businesses and private individuals; the Clusit 2026 Report (Clusit is the Italian Association for Information Security) counts 507 serious incidents in Italy in the same year.
The first hour: what to do right away
- Stay calm and note the time. From this moment on, write everything down: what you see, what you do, who you call.
- Isolate the affected devices. Unplug the network cable and turn off Wi-Fi. Do not switch off the computers: their memory holds information that is useful for understanding what happened. If the attack is spreading, also disconnect the NAS and the backup drives.
- Don’t delete anything and don’t reinstall. Use your phone to photograph the messages on the screen (ransom demand, errors, suspicious emails).
- Call your trusted IT technician. Explain what you are seeing; follow their instructions before doing anything else.
- Notify your cyber insurer, if you have one: policies often include an emergency number and specific rules to follow.
- Change critical passwords from a clean device: email, online banking, management software, VPN. Turn on two-factor authentication if it was missing (→ guide to passwords and MFA).
- If money is at stake, for example a fraudulent bank transfer, call your bank immediately to try to recall it (→ the bank transfer and CEO scam).
What NOT to do
- Don’t pay the ransom on impulse: there is no guarantee you will get your data back, and you become a known target (→ ransomware in offices).
- Don’t restore the backups straight away: first you need to be sure the attacker is out and the backups have not been compromised.
- Don’t use a potentially compromised mailbox to communicate about the incident.
- Don’t hide what happened from colleagues and the owner: whoever clicked must be able to say so without fear.
- Don’t contact the criminals on your own initiative.
The first 24–72 hours: report it and assess your obligations
Reporting to the Postal Police
A cyberattack is a crime. You can file a report (denuncia) at a State Police (Polizia di Stato) office or start it online through the Commissariato di PS Online, the Postal Police’s online portal. Bring your notes, photos and the information you have gathered. The report is also needed for your insurance and for any disputes.
Data breaches and the Data Protection Authority
If personal data is involved (of clients, employees, suppliers), it is likely to be a data breach. The GDPR requires the data controller to notify the Italian Data Protection Authority (Garante per la protezione dei dati personali) within 72 hours of becoming aware of it, unless a risk to individuals is unlikely, and to inform the people concerned if the risk is high. The notification is made using the online procedure on the Garante’s website. In any case, the breach must be recorded in the internal register. Further reading: GDPR security measures and data breaches.
CSIRT Italia
CSIRT Italia, part of ACN, the Italian National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale), receives the mandatory notifications from NIS2 entities (early warning within 24 hours, notification within 72 hours) and has published a guide to incident notification. If your office works as a supplier to a NIS2 entity, also check your contractual obligations to notify it promptly (→ NIS2 for suppliers).
Clients and suppliers
If scam emails have been sent from your mailbox or client data has been exposed, notify the people involved through a secure channel, explaining what happened and what they need to do (for example, ignore payment requests received in your name).
After the emergency: getting back on your feet and learning
- Clean-up: the technician checks that the attacker has not left any hidden access behind.
- Recovery from verified backups, starting with the most critical systems (→ the 3-2-1 backup rule).
- Root cause analysis: how did they get in? Which measure would have stopped the attack?
- Corrective action: two-factor authentication, updates, segmentation, training.
- Update the breach register and the incident procedure.
Preparing in advance: the emergency sheet
The best time to read this guide is before you need it. Prepare a sheet, printed out and also saved outside the office network, with:
- name and mobile number of your trusted IT technician;
- name and contact details of your privacy consultant or DPO;
- the emergency number of your cyber insurer, if you have one;
- your bank’s number for blocking transactions;
- the address of the Commissariato di PS Online and of the Garante’s website;
- who in the office makes decisions and who communicates with clients;
- where the offline backups are kept and who knows how to restore them.
And remember: the sooner an attack is spotted, the less damage it does. Many incidents are discovered only after days or weeks. Strega Defence was created precisely to reduce that time: it watches over the office network, blocks suspicious connections and alerts the owner on their phone straight away, in plain language, explaining what happened, how serious it is and what to do, while keeping a Log that helps reconstruct events and supports any notifications. Discover Strega Defence.
To assess how prepared your office is, take the 10-question checklist.
This article is for general information only and does not constitute specific legal or technical advice. In the event of an incident, follow the instructions of your technician, your privacy consultant and the authorities.
Frequently asked questions
Should I switch off the computer if I think I have been attacked?
No. As a rule, it is best to disconnect it from the network (cable and Wi-Fi) but leave it switched on, because its memory contains information that is useful for the investigation. The exceptions are when your technician tells you otherwise, or when file encryption is visibly in progress and the device cannot be isolated.
How do you report a cyberattack?
By filing a report (denuncia) at a State Police office, which you can also start online through the Postal Police’s Commissariato di PS Online portal. It is a good idea to bring your notes, photos of the messages, suspicious emails and any information you have gathered.
How soon must I notify the Data Protection Authority?
If the attack involved personal data and there is a risk to individuals, the notification must be made without undue delay and, where feasible, within 72 hours of the office becoming aware of it, using the Garante’s online procedure.
Do I need to tell my clients after an attack?
Yes, if their personal data has been exposed with a high risk, as the GDPR requires, and it is advisable in any case if scam emails have been sent in their name from your mailbox. Use a secure channel and explain what they need to do.
Can I restore my files from the backup straight away?
It is better to wait for your technician’s go-ahead. First you need to be certain that the attacker no longer has access to the network and that the backups have not been compromised, otherwise you risk being hit again.
Do I need cyber insurance?
It can be useful to cover recovery costs, consultancy and liability towards third parties, and it often includes an emergency assistance service. It does not replace security measures and usually requires you to have adopted some of them for the cover to be valid.
Sources and further reading
- Commissariato di PS Online – segnalazioni (in Italian) — Polizia Postale.
- Denuncia per reati telematici (in Italian) — Polizia Postale.
- Data breach: notifica al Garante (in Italian) — Garante per la protezione dei dati personali.
- Guida alla notifica degli incidenti informatici (PDF) (in Italian) — ACN, the Italian National Cybersecurity Agency.
- Report annuale Polizia Postale 2025 (in Italian) — Cybersecurity360.
- Rapporto Clusit 2026 – dati principali (in Italian) — Clusit.
- #StopRansomware Guide — CISA.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
