Security
Hacked? Stay calm: the 10-minute emergency plan for small businesses
Strange redirects, unknown admins, spam from your mailbox? What to do in the first ten minutes – and what not to.
From the Security Monster
updated 2 min read
Security Monster says: “Don't delete anything. Secure it first.”
A hacker attack feels like a break-in. The first impulse: delete everything, rebuild everything, somehow quickly. That's exactly what often makes it worse. With this plan, you keep a clear head in the first few minutes.
How to recognise an attack
- Your website redirects to unfamiliar sites or shows strange ads.
- There are new users with admin rights that nobody recognises.
- Customers report spam emails that supposedly come from you.
- Google or your browser warns about your own site.
Minute 1 to 3: Don’t panic
Don’t delete anything and don’t restore an old backup. Take screenshots of everything that strikes you as odd and note the time. These traces help us understand later how the attacker got in – otherwise they’ll be right back at the door after the clean-up.
Minute 3 to 7: Secure your access
Change the most important passwords – and do it from a different, clean device: the email mailbox, the login to the provider's customer centre and the website admin. Where possible, switch on two-step login (an additional code via app or text message) – or go straight to passkeys.
Minute 7 to 10: Get help and inform people
Get support from professionals who secure the evidence, find the vulnerability and thoroughly clean the site. If personal data could be affected, there are reporting obligations towards the data protection supervisory authority – usually within 72 hours. We'll clarify that together with you.
What matters afterwards
After the clean-up comes prevention: regular updates, tested backups, strong passwords and only the extensions that are really needed. That sounds like work – but it's exactly what the Security Monster takes care of for you in the background. What good backups look like is explained in The backup that really saves you.
Our promise in an emergency
The Rapid Response Unit also helps if your tech is with another provider. First you get an assessment and a price, then the solution – and at the end a plain-English explanation of what happened and how to stop it happening again.
Note: This article gives a general overview (as of: 05.11.2026) and is not legal advice. For your individual case, please ask a lawyer.
Sources
- Art. 33 GDPR – Notification of a personal data breach, EUR-Lex
- BSI: Top-10-Ransomware-Maßnahmen – Backups und Wiederanlauf
Sources last checked on 05.11.2026. The links lead to external pages.
Security Monster helps – no rush
Getting hacked is so yesterday.
Don't want to do this alone? Tell us what's going on. First you get an assessment with a price, then you decide.