I think we've been hacked. What do I do first?

Call first. 904-204-6870. What happens in the next hour matters more than anything that happens afterward, and a few common instincts make things worse.

What not to do:

• Do not wipe or reimage anything yet. It destroys what we need to work out how far this went and what was taken, which is exactly what you will later need to answer to an insurer or a regulator.
• Do not just change passwords and assume it is over. Sessions already established survive that.
• Do not email about it from the affected system. If the mailbox is compromised, you are briefing the attacker on your response.

What helps: write down what you saw and when, including anything unusual in the days before. Leave affected machines powered on but disconnect them from the network if you can do that easily. Use phones or a different channel to coordinate.

What we do: contain the accounts, revoke sessions and tokens, preserve logs before retention windows close, establish scope, then clean up. In that order, because doing cleanup first makes the scope question unanswerable.