Cyberattack

Unfortunately, many small-business owners come to the realization that hackers don’t only go after the “big guys.” It’s the “small guys” that are the easier targets. Small businesses are generally not financially prepared for an attack, with many lacking cyber insurance. After disaster strikes, many small businesses may find they have to close up shop altogether. Once the word gets out that a company has been hacked, more than half of their customers say they would be less likely to continue doing business with a company that was breached. It is imperative that small businesses do everything in their power to protect themselves from cyberattacks.

Experts advise mobilizing your breach response team to assess the severity of the cyberattack immediately after you discover the breach. The number of team members will depend on the size of your company.

After the analysis has been completed, experts will guide you as to what systems were affected and when they should be brought offline. As soon as possible, update credentials and passwords of authorized users, as the system will remain vulnerable until this step is taken, especially if the hacker stole your credentials.

If you segmented your network when you initially set it up, check to see that the breach did not migrate to another server or site.

Analyze the backup data and review logs to see who had access when the system was hacked, and plan to interview them for their insights. Remove any sensitive information that may have been posted on your website and check to see if that information appeared anywhere else online.

All states have enacted laws that require you to notify stakeholders of any security breaches that involve personal information. Contact your law enforcement agency and report the cyberattack. If your local police department is not equipped to handle a cyberattack investigation, then contact the FBI or the U.S. Secret Service.

During this process, public relations communications to all stakeholders must be positive. You want to send the message that the company is doing everything possible to remedy the immediate situation and to safeguard against future attacks. You want to rebuild trust with your stakeholders by being proactive. Immediately notify people through email, websites or toll-free numbers that their personal information has been compromised so that they can take steps to limit their exposure. Tell them what type of information has been hacked so they can contact the right organizations. For example, if Social Security information was stolen, people will need to contact the credit card bureaus and put a stop on their credit reports. Encourage people to go to https://www.identitytheft.gov/ and file a report.

Going Forward

Cyber resilience is an idea that is gaining momentum in terms of preventing cyberattacks. The premise is to build safeguards, assuming that a company will at some point be attacked. Once an assessment of what went wrong is completed, companies can take steps to make sure the attack does not happen again. Among best practices are upgrading software, changing passwords systemwide, putting a web application firewall in place, and checking to see that your website hosting company rectifies any security vulnerabilities. If your budget permits, hiring an outside cybersecurity expert may be a realistic next step.

© YC Partners 2026