My server was hacked: what should I do?

My server was hacked: what should I do?

If you suspect a server compromise, contact your IT lead from a trusted device and coordinate isolation of the affected system. Preserve logs and data before reinstalling. The immediate goal is to limit damage and understand the scope; a server that still runs is not necessarily safe.

Get help with my server

Understand the situation before making changes

An unfamiliar sign-in, a new administrator account or unauthorized changes can indicate an incident even without encrypted files. Record what you noticed and when. Do not use the suspected server to change passwords or discuss the response plan.

Isolation needs to account for dependent business services. Avoid routinely powering off the server because volatile evidence may be lost. If isolation is impossible and damage continues, the response team should assess shutdown as a containment measure.

Risks to review

• Reinstalling or deleting files before preserving evidence.
• Connecting backups to a compromised server.
• Assuming the incident is over because antivirus alerts stopped.

Safe recommendations

1. Notify the responsible person through a separate trusted communication channel.
2. Coordinate network isolation without connecting backup drives.
3. Preserve alerts, times and logs; leave forensic acquisition to qualified personnel.
4. Use a clean device to review compromised access and sessions with the administrator.
5. Identify the entry point and validate a backup in isolation before restoring service.

When to seek specialized help

• Suspect your server was hacked? Contact Soportered from a trusted device to assess containment, scope and recovery options. Recoverability depends on the damage and available backups.
• Tell us when it started, how many people are affected and the exact error. Do not send passwords, verification codes or confidential files in the initial message.