We take it offline immediately to stop further damage, restore from a backup we already know is clean, identify exactly how the attacker got in and close that specific hole, then write up what happened and what changed as a result — in plain language, not a jargon-heavy incident report nobody reads. The entry point in these situations is almost always a known vulnerability in something that was overdue an update, which is precisely why the unglamorous, routine maintenance work matters more than it sounds like it should.
We take it offline immediately to stop further damage, restore from a backup we already know is clean, identify exactly how the attacker got in and close that specific hole, then write up what happened and what changed as a result — in plain language, not a jargon-heavy incident report nobody reads. The entry point in these situations is almost always a known vulnerability in something that was overdue an update, which is precisely why the unglamorous, routine maintenance work matters more than it sounds like it should.