Answers
Establish the severity of the breach
Warn customers if login details exposed
Determine when the attack took place
Disconnect infected system from network
Carry out remedial action
Record the lessons learned
Improve employee education and training
Alert the organisation's data protection controller
Find out which services are affected
Identify how attack could be prevented
Increase device hardening
Inform customers, suppliers and business partners
Identify the type of attack used
Protect evidence for possible prosecution
Notify police and National Crime Agency
Work out what went wrong
Invest in new hardware and software
Update interested parties as details emerge
Activate the disaster plan
Contain the threat near its source
Judge how well it was handled
Block unauthorised traffic using a firewall
Restore lost data from backups