Phishing and hacking: Immediate measures and precautions

Hacking and phishing are problems that can affect almost anyone. Many of us have experienced an account being hacked or clicking on the wrong link. But don’t worry, it happens to the best of us! This article explains how to react when something like this happens and what you can do to better protect yourself in the future. It’s important to understand the risks and be prepared. With the right measures, you can minimize the consequences of a hacker attack and restore security.

1 What to do in the event of a hacking attack?

First things first: don’t panic! Anyone can fall victim to a hacker attack or phishing attempt. The key is to stay calm and take the right steps to regain control. It’s normal to feel overwhelmed or even helpless in such a situation, but there are clear and structured recommendations for action that can help to get the situation back under control.

We recommend the following first steps, which will guide you through the process step by step:

• Block accounts: Block all important accounts to prevent further damage. These include, in particular, company bank accounts, central email accounts and all other business-related systems. These are particularly vulnerable because they can often serve as entry points for further attacks. The faster action is taken, the better the damage can be contained. Many banks and service providers offer special emergency numbers that can help you block your account within a few minutes. You should have the contact persons and the relevant numbers ready in advance so that no valuable time is lost in an emergency.
• Regain control over email accounts: Ensure that full control over email accounts is in place. These accounts are often the key to other services, as hackers can use them to reset passwords or gain access to other accounts. Use all the security features the provider offers, such as two-factor authentication (2FA) or an additional security question. It may be helpful to use an additional device to regain control of the email account. If difficulties arise, it is often possible to contact the provider’s customer support directly, who will guide you through the process. Care should also be taken to ensure that security options such as alternative email addresses or phone numbers for recovery are up to date.
• Inform the authorities: Report the attack to the relevant authorities to protect yourself legally. Hacking is a criminal offense, and reporting it can later help to assert claims against the bank or other service providers. In Switzerland, for example, cyber attacks can be reported to the “National Center for Cyber Security (NCSC)”. In Germany, there is the “Zentrale Ansprechstelle Cybercrime (ZAC)” of the police, which offers a point of contact for companies. The Federal Office for Information Security (BSI) also provides important information for reporting cyber incidents. In addition, the GDPR in the EU requires data breaches to be reported to the competent data protection authority within 72 hours if personal data is affected. All steps taken and any communication with the attacker or service provider should be documented. Reporting to the police is not only important for legal protection, but can also help to prevent future attacks by prosecuting perpetrators. In Switzerland, there is also a reporting obligation, which is regulated in the nDSG. Data breaches must be reported to the FDPIC, the Federal Data Protection and Information Commissioner.
• Sophos Rapid Response: For companies that do not have their own processes or are overwhelmed, Sophos offers a Rapid Response Service. This service ensures that immediate and expert help is available when a security incident occurs. Sophos Rapid Response provides rapid analysis and response to threats so that the business is impacted as little as possible.

It is also important to inform all relevant departments in the company if sensitive data is affected. In particular, this includes the IT department, management and, if necessary, the legal department. This ensures that everyone involved is informed about the incident and can take appropriate initiatives to minimize the damage. In the event of an incident involving sensitive customer data, a communication plan should also be prepared in order to inform affected customers promptly and transparently. Clear internal and external communication can significantly limit the damage and ensure that everyone involved knows what measures are being taken.

It’s perfectly normal to feel insecure in a situation like this. It’s important to take the time to take the right steps and get support if necessary. It is not a sign of weakness to ask for help – on the contrary, it shows that you are determined to regain control and prevent harm.

2. dealing with data theft

If you are the victim of a data leak, there are a few things you can do to minimize the damage:

• Change the passwords: Change all affected passwords immediately. Use secure combinations of upper and lower case letters, numbers and special characters. A password manager can help to create secure and unique passwords for each service. Especially for business accounts, it is important to use unique and complex passwords to minimize future risks.
• Account monitoring: Keep an eye on your accounts to spot unusual activity. Many banks and services offer notifications for suspicious transactions. Activate these so that you can react in good time. For companies in particular, it is advisable to secure access to accounts with additional monitoring services. Alarm functions for unusual or unexpected activities should be activated so that potential problems can be identified and rectified immediately.
• Notify services: Inform affected services so that they can take additional security measures. Many providers have special teams that can assist in securing accounts. This also applies to enterprise software and cloud services, which should also be informed of the incident. Companies should be able to quickly adapt existing security policies and improve cooperation with the provider’s security services to bring the situation under control.
• Contact credit card companies and banks: Credit card companies and banks should be informed immediately about possible high debits. In case of doubt, the affected cards should be blocked to prevent further misuse. A quick response not only helps to avert financial damage, but also to maintain an overview of all financial activities and ensure transparency.
• Identity theft monitoring: In cases where personal data such as name, address or social security number has been compromised, identity theft monitoring can help. Some companies offer special services that monitor the misuse of personal data and sound the alarm early in the event of irregularities. This can offer companies and individuals additional security by identifying potential risks at an early stage.
• Configure alarms and notifications: Companies should configure existing alarm and notification systems so that precautions can be taken immediately in the event of unusual activities. This also includes the integration of SIEM systems (Security Information and Event Management), which help to bundle and analyze security-relevant information.

3. long-term provision

In addition to immediate measures, there are also many things that can be done to ensure long-term security. In the best case scenario, companies should already have a scenario and corresponding processes in place to be able to respond to such incidents quickly and in a structured manner. A well-documented incident response strategy can make all the difference when it comes down to it.

• Awareness training: Phishing is one of the most common methods used to obtain data. With training such as Sophos Phish Threat, you can learn to better recognize such threats and thus ward off attacks. If you want to go even deeper, you can use tools such as KnowBe4, which offer advanced training and courses. These programs not only help build basic security awareness, but they also promote a culture of vigilance and prevention throughout the organization.
• Network security with firewalls: A good firewall, such as the one from Sophos, can help ward off attacks on the network before they cause damage. Especially in conjunction with endpoint protection, a comprehensive line of defense is created. This is particularly important for companies that store and process sensitive data, as attacks on networks are often the first step in a larger attack.
• Managed Detection and Response (MDR): Sophos offers MDR services to help detect and respond quickly to suspicious activity. This can be particularly helpful for those who do not deal with cybersecurity on a daily basis but still want to be sure that their devices are well protected. MDR ensures that the network is continuously monitored and that attacks can be warded off at an early stage.
• Secure passwords: Use secure and different passwords for all accounts. A password manager can help you keep track of your passwords. It’s a good idea to change passwords regularly, especially if you have the feeling that something is wrong. In addition, passwords should never be reused to avoid the risk of an attack via an already compromised account.
• Two-factor authentication (2FA): Activate two-factor authentication wherever possible. It ensures that an attacker cannot simply access the account even though they know the password. Many services offer 2FA via SMS, app or special hardware tokens. It is advisable for companies to make this method mandatory for all employees, especially for sensitive systems such as email and cloud services.
• Regular updates: keep software and devices up to date. This applies to operating systems, apps and devices such as routers. Automatic updates help to close security gaps quickly. Security gaps are often the gateway for attackers, so a regular update process is crucial for system security.
• Sophos Managed Risk is a service that helps companies to identify security risks at an early stage and manage them proactively. Through continuous monitoring and targeted threat analysis, Sophos Managed Risk provides strong support in minimizing cyber risks.
• Be careful with emails and links: Do not click on suspicious links in e-mails or messages. This is exactly how many attacks start. If you are unsure whether a message is genuine, you should check the information directly on the sender’s official website. Companies should consider using anti-phishing software that identifies and blocks potentially dangerous emails.

Regular data backups are also important. If your computer or account is hacked, you can at least fall back on an up-to-date backup of your data and limit the damage. Companies should ensure that all important data is not only backed up locally, but also in the cloud to guarantee availability in the event of an emergency. More rules under: Cybersecurity best practices

4. important information and studies

Every year, Sophos publishes detailed studies that show how the threat situation is developing in various industries. These studies provide valuable insights into how organizations are affected by ransomware and other cyberthreats and what steps have been most effective in fending off attacks. Here are some of the latest findings from different sectors:

• Ransomware in manufacturing and production (2024): A recent study showed that 65% of companies in the manufacturing and production industry were affected by ransomware in 2024. This represents a significant increase compared to previous years (56% in 2023 and 55% in 2022) and highlights how the threats to this industry have intensified. Of particular concern is that the majority of attacks are due to vulnerabilities in IT systems, with 29% of attacks due to malicious emails and 27% due to exploited vulnerabilities.
• Ransomware in the retail sector (2024): The study for the retail sector showed that 45% of the companies surveyed were affected by a ransomware attack in 2024. This is a welcome decrease compared to 2023 and 2022, when the rate was 69% and 77% respectively. A notable point is that 92% of affected organizations reported that cybercriminals attempted to compromise their backups during the attacks, with almost half of these attempts (47%) being successful. Such statistics highlight the need for robust backup strategies and comprehensive protection of backup systems.
• Particular challenges in the industry: The survey results also show that the way in which attacks start varies depending on the industry. In retail, security vulnerabilities in systems and malicious emails were the most common entry points for attacks. It is clear that a comprehensive IT security strategy is needed that includes both technical
  methods (such as patching and system updates) and employee training to prevent such attacks.
• Findings on root cause analysis: Interestingly, in almost all industries, companies that were affected by ransomware were able to identify the causes of the attacks. This underlines the importance of thorough root cause analysis to close system vulnerabilities and prevent future attacks. The most common causes include security vulnerabilities, malicious emails and the exploitation of stolen login credentials.

These studies highlight the need for a proactive cybersecurity strategy that includes technical procedures such as endpoint protection and firewalls as well as preventative measures such as phishing protection training and regular security audits.

Conclusion

Hacking and phishing can affect anyone. The most important thing is to stay calm, secure all affected accounts and waste no time. Working with experts, using protective measures such as MDR and involving the relevant authorities are crucial. In the long term, prevention is the key: risks can be significantly minimized with secure passwords, two-factor authentication and awareness training. Companies should always be prepared and regularly review their processes so that they can react quickly in the event of an emergency.