You have been hacked
What to do in the first hour after a compromise, and what India requires in the first six: the containment order, the evidence that cannot be recreated later, and the CERT-In, RBI and SEBI filings that fall due meanwhile.
Answered 24/7 for active incidents. If systems are still running, do not rebuild, reimage or power them down before you call.
10 guides, published by Security Brigade and last updated .
The first hours
What to do before anything is rebuilt, and what is lost the moment you do.
Preserve it before you rebuild
Powering the machine off, restoring from backup, re-imaging, and quietly cleaning up are four reasonable instincts, and each destroys something n…
The first hour, and the first seventy-two
The order to work in from the moment you find out: what to stop doing, what to preserve, who to call, and what CERT-In's Direction (ii) of 28 Apr…
By what actually happened
Ransomware, a compromised mailbox, a defaced site: the paths out differ by incident.
Ransomware recovery: the paths out, in the order they are tried
Data comes back one of four ways: a backup restore that has actually been verified, a free decryptor for the family you are really dealing with,…
What ransomware negotiation actually looks like
The sanctions question comes before the price question, and it decides whether there is anything to discuss at all. What a negotiation channel do…
Which ransomware is this, and what the family name decides
You know you are encrypted. You do not yet know by what, and the questions that follow are all questions about the family: whether a free decrypt…
Business email compromise — the money left this morning
A payment went to an account that was not your supplier's. The instinct is to chase the money, and that is right. But a BEC is a mailbox intrusio…
Website defacement, or a Google warning on your site: the first hour
A replaced homepage, or a Chrome warning on your site. What to copy before you touch the server, and the CERT-In clause that puts a defaced site…
What the ransom decision actually turns on
By the time the question reaches you it is usually framed as pay or don't. It is really five separate findings, and four of them can be establish…
Working out how they got in
What the logs can still answer, and what the retention window already decided.
What you owe a regulator, and when
The six-hour clock, who else has to be told, and what is actually sent.
If this is happening now
Preservation first, and the filing is due either way.
The acts that end an investigation are the ones somebody reaches for in the first ten minutes: power it off, restore over the top, re-image it, clean up the page. Tell us what you have found and what has already been touched, and you will get the containment order, the preservation steps and your filing position in writing. Security Brigade has been CERT-In empanelled since 2008 and works incidents 24/7.