Gehackt? Wir helfen sofort.
Professionelle IT-Sicherheit nach Cyberangriff – Schnell. Sicher. Zuverlässig.
Notfall-Hotline
Unsere IT-Sicherheitsexperten sind rund um die Uhr für Sie erreichbar. Bei einem Cyberangriff zählt jede Minute.
Was tun nach einem Hack?
Organizational Measures
Keep calm
Contact our emergency hotline immediately. Our experts will guide you through the first critical minutes.
Set up crisis management team
Even in critical security incidents, it is important to act calmly. Hasty decisions can complicate the analysis and cause further damage.
Please observe reporting obligations
Depending on the incident, there may be legal or contractual reporting obligations, for example to data protection authorities, customers, insurers, or business partners.
Involve external support early
IT security service providers, forensic experts, lawyers, or insurance companies can play a crucial role in minimizing damages and avoiding mistakes in crisis management.
Check Available Data Sources
For short-term emergency operations, important data may also be available at external locations, mobile devices, or systems used by employees that have not been affected so far.
Assume a data leak
In many cyber attacks, companies must assume that data has been copied or exfiltrated. Therefore, the assessment of potential data privacy and information leaks should be done early on.
What to do after a hack?
Technical Measures
No sign-in with administrator accounts
One of the most important immediate actions is: Never log in with privileged user accounts or administrator accounts on a potentially compromised system while it is still connected to the corporate network or the internet.
This could allow access credentials to fall directly into the hands of attackers.
Isolate infected systems immediately
To prevent further spread of the malware, affected systems should be immediately disconnected from the network.
Rebuild Compromised Systems
Malware often alters critical areas of the system that are related to security. These changes can often not be reliably reversed.
Therefore, the Federal Office for Information Security (BSI) generally recommends completely reinstalling compromised systems.
Check Active Directory and permissions
Modern attacks often use stolen credentials to laterally spread within the network.
Special attention is given to:
Active Directory
Domain Controllers
Server Systems
Administrator Accounts
In case of compromise, all affected systems should be rebuilt, and all privileged accounts should be reviewed.
Consistently change passwords
All access credentials stored on affected systems or used after the infection are considered compromised.
A complete password change should be done promptly.
Check backups
Before performing a restoration, make sure that available backups have not been compromised or encrypted as well.
Only clean and verified data backups should be used for restoration.
Restrict remote access
After an attack, it should be checked whether the entire network needs to be rebuilt. Especially after a compromise of the Active Directory, a complete reconstruction of the central infrastructure is recommended to eliminate any remaining backdoors or attacker access.
Ihre IT-Sicherheit in erfahrenen Händen
Seit über 25 Jahren ist EasyHood eG Ihr verlässlicher Partner für IT-Infrastruktur und IT-Sicherheit. Unser Team aus 20 hochqualifizierten IT-Spezialisten verbindet technische Exzellenz mit menschlicher Kompetenz.
25 Jahre Erfahrung
Fundiertes Wissen in IT-Sicherheit, Cloud-Lösungen und Netzwerk-Architekturen
Cloud-Expertise
Spezialisiert auf Microsoft Azure und Microsoft 365 für maximale Sicherheit
Persönliche Betreuung
20 Spezialisten betreuen mittelständische Unternehmen mit Herz und Verstand
Unser Ziel: Technologie so einsetzen, dass sie Ihr Unternehmen effizienter, sicherer und zukunftsfähig macht. Komplexe IT-Themen machen wir einfach und verständlich – strukturiert, geplant und mit dem Fokus auf nachhaltigem Erfolg.
Unsere IT-Sicherheitsleistungen
Umfassende Lösungen für Ihre digitale Sicherheit und Wiederherstellung
Notfall-Response
Sofortige Reaktion auf Cyberangriffe mit Schadensbegrenzung und Systemwiederherstellung
Azure Security
Absicherung und Optimierung Ihrer Microsoft Azure Cloud-Infrastruktur
Microsoft 365 Security
Komplette Absicherung Ihrer Microsoft 365 Umgebung mit erweiterten Sicherheitsfeatures
Infrastruktur-Sicherheit
Planung und Implementierung sicherer Netzwerk-Architekturen für Ihr Unternehmen
Security Audit
Umfassende Sicherheitsanalyse Ihrer IT-Systeme mit detaillierten Handlungsempfehlungen
Security Training
Schulungen für Ihr Team zur Sensibilisierung und Prävention von Cyberangriffen