What to Do First When a Business Server May Be Compromised

If a business server shows unfamiliar accounts, unexpected outbound traffic, altered files, or a credible security alert, treat the situation as an incident until it is understood. A rushed reboot or cleanup can remove evidence and make it harder to learn how access occurred. The immediate priority is to protect people and critical services while preserving information for investigation.

Stabilize without destroying evidence

Use a trusted communications channel to coordinate responders. Record the time, system name, observed symptoms, and actions already taken. If active harm is continuing, isolate the affected host from the network using a planned control, while considering dependencies and business impact. Avoid logging in from a potentially compromised administrator workstation.

Preserve and scope

• Save relevant alerts, authentication logs, firewall events, and cloud audit records.
• Identify related accounts, systems, backups, and external services that share credentials.
• Do not delete suspicious files or accounts until evidence is captured and the response owner approves containment steps.
• Rotate credentials from a clean device after deciding the order and scope.

Plan recovery and prevention

Restoring a clean backup is only part of recovery. Confirm the entry path is closed, privileged access is reviewed, and monitoring can detect a repeat. Document what is known, what remains uncertain, and which systems require heightened monitoring.

Informatix Systems lists cybersecurity and incident response related services. An assessment can help scope affected systems and organize containment and recovery steps. Contact Informatix Systems if you need help evaluating a suspected compromise.