One morning, employees find they can’t log in, the administrator password no longer works, and there are unfamiliar accounts and files on the server—this isn’t a broken computer, it’s a company that has been breached. Servers brute-forced, passwords changed, data ransacked or even encrypted for ransom—these are real threats that small and medium businesses face with growing frequency. When it actually happens, what you do in the first few hours directly determines the scale of the loss. Today we’ll make it clear: when you discover your server has been compromised, what to do first and how to prevent it afterward.
First, recognize the signs: these may mean you’ve already been breached
Passwords suddenly stop working, administrator accounts are changed; unfamiliar user accounts appear on the server; there are unrecognized programs and scheduled tasks running; CPU/network usage spikes for no reason (possibly crypto-mining or data exfiltration); files are encrypted in bulk and ransom notes appear; login logs show large numbers of failed attempts from unfamiliar IPs—these are all typical signs of a breach. If you see several of these, treat it as a security incident, not an ordinary glitch.
First steps: stop the bleeding, don’t rush to reinstall
Many people’s first instinct is to “reinstall the system right away”—don’t. Reinstalling destroys the investigation trail, and without finding the entry point, you’ll be breached again just as quickly. The correct order of handling is:
- ① Isolate, cut off the spread: Disconnect the compromised machine from the network (unplug the cable or block it at the firewall) to prevent the attacker from continuing to operate and to prevent the malware from spreading laterally to other machines on the internal network.
- ② Preserve the scene: Don’t restart, don’t rush to delete things. Logs, suspicious files, and accounts are key evidence for determining “how they got in”—capture photos or export what you can first.
- ③ Change all related passwords: From another clean device, change every password that may be affected—servers, admin panels, databases, email—especially reused weak passwords.
- ④ Assess the scope of impact: Confirm which machines and which data have been touched, whether any data has been exfiltrated or encrypted, and don’t focus only on the first machine you discovered.
Find the entry point: where attackers usually get in
- Brute-forcing weak passwords: Remote Desktop (RDP), SSH, and databases exposed directly to the public internet, combined with weak passwords, can be cracked by automated tools within hours. This is the most common entry point.
- Unpatched old vulnerabilities: Known high-risk vulnerabilities in systems or software (such as the classic EternalBlue) left unpatched are picked off easily by off-the-shelf tools.
- Phishing/Trojans: Employees click a phishing email or install infected software, giving attackers a foothold to penetrate further.
- Vulnerable public-facing services: Websites, OA systems, and other externally exposed systems have their own security flaws that, once exploited, hand over the server.
Cleanup and recovery: confirm it’s clean before going back online
Only after stopping the bleeding and finding the entry point can recovery begin. The key is ensuring the attacker’s foothold is completely removed and the entry point is sealed off, then returning the system to business: remove malicious accounts, programs, scheduled tasks, and backdoors; patch the exploited vulnerabilities and close the public ports that should be closed; restore data from a backup confirmed to be clean (this is also why regular offline backups matter so much—when you’re hit by ransomware, they’re what gives you the confidence not to pay); once everything is handled and confirmed free of remnants, reconnect to the network and resume services.
Prevent the next one: shore up these lines of defense
- Don’t expose RDP/SSH/databases directly to the public internet: Access them through secure channels such as zero trust/VPN, and keep business ports invisible to the public internet.
- Strong passwords + multi-factor authentication: Eliminate weak and default passwords, and enable two-factor verification for critical systems.
- Patch promptly: Keep systems and key software updated; don’t give old vulnerabilities a chance.
- Deploy a firewall + intrusion prevention: Block brute-force attacks and known exploits at the network entry point, and retain logs for traceability.
- Internal network segmentation + offline backups: Segment and isolate to prevent lateral spread; a 3-2-1 backup lets you recover even in the worst case.
Frequently Asked Questions
Q: If I discover a breach, can’t I just reinstall the system?
A: Reinstalling right away is not advisable. Without isolating first and finding the entry point, you’ll often be breached again soon after reinstalling; and reinstalling destroys the investigation evidence. You should first isolate, preserve the scene, and find the entry point, then clean up and recover.
Q: My data has been encrypted for ransom—should I pay?
A: Paying the ransom is not advisable—payment doesn’t guarantee you’ll get the decryption key and may invite a second round of extortion. Your real leverage is having a clean offline backup in place; restore directly from it. That’s why backups must be made in advance and tested regularly for restorability.
Q: We don’t have security staff—what if we can’t handle it ourselves when something happens?
A: Security incident response is highly specialized and time-critical. If you’re not confident handling it yourself, find a professional cybersecurity service provider for emergency response as soon as possible—the earlier they get involved, the smaller the loss. It’s also wise to invest in prevention and monitoring in normal times rather than waiting for something to happen.
Q: Do small companies get targeted too?
A: Yes, and plenty of them. Much of the attacking is automated and doesn’t pick targets—as long as you have weak credentials or old vulnerabilities exposed to the public internet, you’ll be scanned. Small companies have weaker defenses, which actually makes them easier marks.
Server breached or held for ransom, scrambling to put out the fire without a security team?
Siwenlide provides emergency security incident response and day-to-day protection for small and medium businesses in Beijing and surrounding areas: rapid isolation and handling, entry-point investigation, cleanup and recovery, plus help shoring up the defenses of firewalls, intrusion prevention, zero trust access, internal network segmentation, and offline backups—so the next one can’t get in. Prevention beforehand is far less stressful than firefighting afterward. Visit siwenlide.com or call 400-686-2011—for urgent situations, call us directly.
