My MSP client got hacked. What do I do first?
Contain the damage, protect your own tools, preserve evidence, and inform the client's decision-makers, in that order and quickly. Isolate affected machines from the network without switching them off. Check whether the attacker used your remote-management or remote-access tool; if that is possible, suspend those sessions and reset the credentials for all clients, not just this one. Keep logs and alert history. Call an incident-response firm if the incident goes beyond your skills, and tell the client's management what you know and what they must decide, including possible reporting under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. or the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., which stays their duty. NetSenX shows the client's alert timeline, lateral movement and unusual uploads, which helps answer when it started and what left.
Read next
Related questions
- Can an attacker pivot from a client network into the MSP's tools?
- How do we detect misuse of our RMM tool in client networks?
- What should an MSP monitor to detect a compromise of its own tools?
- How can an MSP add night and weekend coverage for clients without hiring?
- What can an MSP promise clients about after-hours security monitoring?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).