# My MSP client got hacked. What do I do first?

Contain the damage, protect your own tools, preserve evidence, and inform the client's decision-makers, in that order and quickly. Isolate affected machines from the network without switching them off. Check whether the attacker used your remote-management or remote-access tool; if that is possible, suspend those sessions and reset the credentials for all clients, not just this one. Keep logs and alert history. Call an incident-response firm if the incident goes beyond your skills, and tell the client's management what you know and what they must decide, including possible reporting under NIS2 or the GDPR, which stays their duty. NetSenX shows the client's alert timeline, lateral movement and unusual uploads, which helps answer when it started and what left.

FAQ: [MSPs and MSSPs](https://netsenx.com/en/faq/msp) · https://netsenx.com/en/faq/my-msp-client-got-hacked-what-do-i-do-first

## Read next

- https://netsenx.com/en/problems-we-solve
- https://netsenx.com/en/partners

## Related questions

- [Can an attacker pivot from a client network into the MSP's tools?](https://netsenx.com/en/faq/can-an-attacker-pivot-from-a-client-into-the-msps-tools)
- [How do we detect misuse of our RMM tool in client networks?](https://netsenx.com/en/faq/how-to-detect-misuse-of-an-rmm-tool-in-client-networks)
- [What should an MSP monitor to detect a compromise of its own tools?](https://netsenx.com/en/faq/what-should-an-msp-monitor-to-detect-a-compromise-of-its-own-tools)
- [How can an MSP add night and weekend coverage for clients without hiring?](https://netsenx.com/en/faq/how-can-an-msp-add-night-and-weekend-coverage-without-hiring)
- [What can an MSP promise clients about after-hours security monitoring?](https://netsenx.com/en/faq/what-can-an-msp-promise-about-after-hours-monitoring)