# What should we avoid doing during a cyber incident?

A short list of common mistakes. Do not wipe or rebuild machines before evidence is saved, or you lose the means of finding out how the attacker got in. Do not reset passwords one by one while the attacker is still watching; plan containment and do it in one go. Do not discuss the incident over e-mail or chat that may be compromised. Do not contact or pay the attackers without advice from your responder, insurer and lawyer. Do not restore from backups before you know they predate the intrusion. Do not announce publicly what you do not yet know, and do not promise customers that no data was affected before you have checked. Do not miss deadlines: a NIS2 early warning or a GDPR notification can be sent with incomplete facts and completed later. And do not stop watching the network once systems are back.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do we find patient zero, the first machine the attacker compromised?](https://netsenx.com/en/faq/how-to-find-patient-zero)
- [What is a forensic image, and when do we need one?](https://netsenx.com/en/faq/what-is-a-forensic-image)
- [What is chain of custody for digital evidence?](https://netsenx.com/en/faq/what-is-chain-of-custody-for-digital-evidence)
- [How do we preserve logs before they are overwritten?](https://netsenx.com/en/faq/how-to-preserve-logs-before-they-are-overwritten)
- [What does eradication mean in incident response?](https://netsenx.com/en/faq/what-does-eradication-mean-in-incident-response)