Your Company Got Hacked? Critical Steps in the First 60 Minutes

It is 09:14 on a Monday. The warehouse team cannot open today's delivery orders. Finance computers are showing the same strange message. IT reports that the file server has stopped responding. Then the note appears on every screen: your files, databases and backups are encrypted, and you have 72 hours to make contact.

Nobody in the building has been through this before. What they do in the next hour decides whether this becomes a hard day or a disaster.

That fictional scenario opened Zentara's webinar, "Perusahaan Anda Di Hack? Langkah Krusial dalam 60 Menit Pertama" (Company Hacked? Crucial Steps in the First 60 Minutes). The session laid out the crucial steps for the first 60 minutes after a cyberattack as a minute-by-minute map. Every block on that map ends in a decision that a person has to make, not a system. This article covers the same ground.

Why Indonesian Businesses Need a Plan

BSSN recorded around 5.16 billion traffic anomalies on Indonesian networks, roughly 182 potential attacks every second (cited by Antara News, 6 August 2026). Three points from the session put that number in context:

• No company is too small. Attacks on Indonesian networks happen every second, and being based in Indonesia offers no protection.
• Mid-sized companies are hit most often. Large enterprises have their own security teams, and micro businesses hold little worth stealing. Companies with real revenue and a one-person IT team sit in between.
• Attackers walk in through basic controls. Remote access open to the internet, reused passwords, unpatched firewalls, and hijacked email accounts used to change the bank details on invoices.

Why the First Hour Decides How Bad It Gets

Three things happen at the same time, and each gets worse with every minute of delay:

• The attacker keeps moving while you discuss. While the team debates whether it is really an attack, more computers are encrypted and more data is copied out.
• Evidence disappears on its own. Logs get overwritten, and memory is lost when machines are switched off. A rushed clean-up erases the only trace of how the attackers got in, which leaves the same gap open after recovery.
• The most expensive decisions arrive when information is thinnest. Pay or not, tell customers or wait, keep operating or shut down. All of them get decided in a panic, with incomplete facts.

The First 60 Minutes, Step by Step

Minute 0: You Rarely Get a Clean Alarm

The scenario did not start with an alarm. It started with small, irritating complaints, and that is typical. Three reasons attacks get missed early:

• Early symptoms look like ordinary faults. Files will not open, a shared folder is empty, systems slow down. Almost everyone's first thought is that something broke, not that someone got in.
• Attackers choose nights, weekends and holidays, when approvals take longest and the fewest people are watching.
• The first person to notice stays quiet for fear of blame. They wait until they are sure, and that silence costs the first thirty minutes.

Often the news comes from outside. A customer or partner calls about an invoice with a different bank account, or a link that suddenly will not open. A bank holds a transfer because it does not match the usual pattern. Or company files show up on a leak site or in the press, by which point the attackers have usually been inside for weeks.

Four warning signs can be spotted from everyday work, without reading a single log:

• Bank details on invoices change, or payments get approved by someone who never saw the original invoice.
• Files are renamed in bulk with new extensions, and a README ransom note appears in every folder.
• Antivirus, EDR or backups stop running without anyone changing them, or backups fail several days in a row with no alert.
• Accounts behave out of character: password resets nobody requested, logins from abroad, or a successful login at 3 a.m. from an unknown device.

Minute 1 to 10: Confirm It, Then Raise the Alarm

Three things must happen in the first ten minutes, and the order matters:

1. Assign one person to decide whether this is an attack or a technical fault, with a deadline measured in minutes. If there is no conclusion by then, treat it as an attack. A false alarm costs, at most, an hour of work.
2. Declare it an incident. Until someone says it out loud, everyone still treats their routine work as more important.
3. Call the owner or director within the first ten minutes, even with incomplete information. Report what is known, and say clearly what is not.

A live poll asked the audience who they would call first. Calling IT or the IT vendor was the most common answer. They help on the technical side, but they have no authority over money, customers or legal risk. Calling the owner or director is harder at 7 a.m., but that is the person who must approve every step after this. The answer that most often reflects reality is the third: nobody has ever decided. That is exactly why the call list has to be written before an incident.

Write the call list before you need it. One page, printed, and kept outside any system that could be affected:

• Internal contacts: the owner, the response lead, the person responsible for IT, and the spokesperson to staff, plus who covers for each of them when they are on leave.
• External contacts: your IT partner, insurer, legal counsel and bank, with mobile numbers. Email alone is not enough, because office email may be part of what is compromised.
• One named decision-maker authorised to approve spending and public statements, plus a deputy. Without a clear name, decisions stall because nobody feels entitled to make them.

As Jose put it, the most expensive mistake he sees is not technical. It is silence. IT staff often try to fix the problem quietly before anyone finds out, and "wait and see" feels safe because nothing has been announced. Meanwhile, the only thing growing is the number of affected machines.

Minute 10 to 20: Contain Without Erasing Evidence

The principle is isolate, do not erase. Ransomware and attackers move from machine to machine across the network, so disconnecting closes the path while the machine's contents stay available for investigation. Shutting down wipes memory, including encryption keys and running processes, and that evidence cannot be recovered. Restoring too early has its own cost: if the way in is still open, freshly restored data can be encrypted again within hours. Close the gap first, then restore.

Minute 20 to 40: Know What Is Hit First

Three questions, answered in business language rather than server names:

• Which work has stopped? Invoicing, shipping goods, running payroll, serving customers. That list is useful to an owner. A list of server names is not.
• How far has it spread? One laptop, one division, or everything, including any system customers use to log in, because that decides whether outside parties are affected.
• Was data encrypted, or copied out? Encrypted data is an operational problem. Data taken out is a legal problem, with notification obligations.

Check the backups before promising anything. Almost every company says its backups are safe, and that is only proven by an actual restore. A backup drive that stays connected to the network gets encrypted along with the data it was meant to protect, so you need a copy that is physically disconnected. Promising customers "back to normal tomorrow" and then discovering the backup is broken costs more trust than the downtime itself.

Personal data changes the rules. Indonesia's Personal Data Protection Law (UU PDP, Law No. 27 of 2022) requires organisations to protect personal data and to notify people whose data has leaked, with a short deadline that starts earlier than many expect. Ask early whether customer, employee or patient data is involved, because the answer changes who must be told and how fast. Bring in legal counsel before making any statement to outsiders. A careless statement in the first hours can create new legal problems of its own. (The session covered UU PDP at awareness level only, not as legal advice.)

The first hour is the worst time to decide on a ransom. Paying does not guarantee the data comes back: the decryption tool is written by criminals and is often slow, incomplete, or fails on the files you need most. Paying does not delete copies already taken, and some victims are extorted a second time by the same group. The decision belongs to the business owner, not IT, and legal counsel and the insurer should be involved before anyone replies to the attacker.

Minute 40 to 60: Tell Staff First, Then the Insurer

Notification follows a clear order:

1. Staff first: what happened, what not to click, and who the spokesperson is. They are already asking each other, and if you do not explain, the version that spreads comes from outside.
2. The insurer, as soon as possible. Many policies have reporting deadlines, and many include an incident response team whose cost is already covered by your premium.
3. Affected customers and partners, briefly and factually: what happened, what it means for them, and what is being done. Nothing more, and no speculation.
4. Authorities where required, following legal counsel's direction on which rules apply and when the clock starts.

The session compared three ways to handle the same hour. Panic means hourly updates and recovery dates nobody has checked, and a date that keeps slipping does more damage than the incident itself. Silence means customers imagine the worst and staff hear the story from outsiders. Calm and honest means one spokesperson, one statement, and a clear time for the next update, with no guessing and no promises the technical team has not confirmed. Only the last one ends well.

Minute 60: The Hour Ends, the Long Road Starts

By the end of the hour, the spread should be contained, but recovery takes days to weeks. Three things carry forward:

• Keep the evidence and written notes. Insurance claims and the investigation both depend on what was secured on day one.
• Prepare for a second wave. Expect phishing that uses your company's name, and attackers returning through any gap left open. Your customers become the next targets.
• Set realistic expectations. The first 48 hours go to mapping and containing the damage. Core systems can return within days if backups are clean and tested, starting with the work that keeps the business running: invoicing, shipping and customer service. Full recovery, including cleaning every machine and closing the gaps, takes weeks. Rebuilding customer trust takes longest, and there is no shortcut.

Before It Happens: Controls That Change the Outcome

The second half of the session turned to prevention, grouped into four areas.

Identity. Most intrusions start with one valid login.

• Require MFA with passkeys or FIDO2 keys for all remote access. SMS codes and push approvals can be phished or spammed until the victim taps "approve".
• Disable legacy protocols that bypass MFA, remove former employees' accounts within a day, and review service accounts every quarter.
• Keep admin accounts separate from daily work, so one compromised inbox cannot take down the whole domain.

Exposure. Attackers scan every IP address on the internet, so yours has already been scanned.

• Run external VAPT every quarter. Teams that do it almost always find a forgotten test server, an old portal, or vendor equipment nobody owns.
• Patch perimeter devices such as firewalls, VPN gateways and mail gateways within days, not on the monthly cycle.
• Never expose RDP or SMB directly to the internet. Route remote access through a VPN with MFA.

Recovery. Backups are the only control that brings the business back without paying anyone.

• Keep three copies on two types of media, with one copy immutable (it cannot be changed or deleted, even by an admin) or fully disconnected.
• Test the restore, not the backup status, and record how long it takes. A green status only means data was copied.
• Use a dedicated backup account that is not a domain admin and is not reused anywhere else.

Detection. Nothing can be responded to if nobody is watching.

• Deploy EDR on every endpoint and server in blocking mode, not monitoring only. Ordinary antivirus does not see an attacker typing commands by hand.
• Send logins, endpoint and firewall logs to central storage off the machine, and keep them for at least 90 days.
• Segment the network so servers, workstations and backups are separated, and practise cutting off a segment before you need to.

From the Q&A

Do attackers really bother with a company our size? Yes. Most attacks are not aimed at anyone in particular. They scan the internet for open systems and weak passwords, and company size does not factor in. Small firms are also used as a way into the larger customers and partners they work with, and thin cash reserves make them more likely to pay quickly, which is exactly the pressure attackers look for.

If we can only do one thing, what should it be? Start with the written call list, which is free and takes an hour. Then a tested offline backup, the only way to recover without paying. Then MFA on email and remote access, since most intrusions begin with one stolen password.

Three Things to Do Before You Leave the Office

None of these need budget approval, and all of them can be done this week:

1. Write a one-page call list. Who to call, in what order, with mobile numbers. Print it and keep one copy off the office network.
2. Test one offline backup. Find one backup that is truly disconnected and restore a single file from it, starting with your most critical system. Record how long it takes. That number is what you will rely on when promising a recovery date to customers.
3. Name the decision-maker. Write down who approves spending and public statements during an incident, and who takes over if they cannot be reached.

Final Thought

Nobody gets the first hour of an attack perfectly right. The companies that recover well are the ones that already know who decides, who gets called, and which backup they can trust, so the hour goes to containing the damage instead of working out who is in charge.

Zentara's SOC team monitors and responds to incidents like this around the clock, and helps organisations get these basics in place before they are needed. If you missed the session, you can watch the full hour on YouTube.

If you want to check how ready your organisation is for its own first 60 minutes, talk to our team.