Phishing attacks are one of the most common cyber threats facing businesses today — and with AI now being used to craft convincing fake emails, even the most tech-savvy employees can be caught off guard. A link that looks completely legitimate can, in just one click, expose your business to malware, data theft, or a full-blown ransomware attack.

The good news? Acting quickly can make all the difference. If someone in your company has clicked a suspicious link, don’t panic — but don’t wait either. The steps you take in the next few minutes are critical to containing the damage and protecting the rest of your network.

Here are the 5 things you should do immediately.

Step 1: Isolate the Device Immediately

The very first thing you should do — before anything else — is cut the affected device off from the internet. Every second it remains connected gives malware more opportunity to spread across your network, exfiltrate data, or communicate with the attacker’s servers. Speed is everything here.

How to disconnect, depending on your setup:

• WiFi connection — Go to your computer’s network settings and turn off WiFi, or click the WiFi icon in your system tray and disconnect. If you can’t do this quickly, simply turning off your router will disconnect every device on the network, which may be the right call if you suspect the threat has already spread.
• Wired (Ethernet) connection — Physically unplug the Ethernet cable from your device or from the wall. This is the fastest and most reliable way to isolate a wired machine.
• Laptops — Use the physical WiFi toggle if your device has one, or switch to Airplane Mode immediately, which disables all wireless connections in one step.

Don’t turn the device off yet. It may be tempting to shut the machine down, but keeping it on preserves important forensic evidence — such as running processes and memory logs — that your IT team may need to investigate what happened and how far the threat has spread.

Once the device is isolated, leave it alone and hand it over to your IT team or managed service provider to assess. Don’t attempt to clean it yourself, as this risks destroying evidence or missing hidden threats.

Step 2: Report the Incident Right Away

As soon as a phishing link has been clicked, it’s essential to tell the right people — fast. If you’re not responsible for your company’s IT or cybersecurity, notify your manager or IT team immediately. Don’t be embarrassed; it happens to everyone, and the quicker it’s reported, the quicker it can be contained.

Your IT team or managed service provider (like Digital Orchard IT) will log an incident report, begin an investigation, and assess what data or systems may have been affected. If there’s any possibility that financial accounts, payment details, or sensitive business data have been compromised, your finance team should be alerted straight away so they can contact your bank and, if necessary, freeze or monitor affected accounts.

In serious cases — particularly where data has been stolen or a financial crime has occurred — it may also be necessary to report the incident to Action Fraud (the UK’s national fraud and cybercrime reporting centre) or the Information Commissioner’s Office (ICO) if personal data is involved under GDPR obligations.

Step 3: Reset Passwords

After a phishing incident, you have to assume that any credentials stored on or accessed from the affected device may have been captured. Attackers often move fast — so you need to move faster. Reset passwords immediately for any accounts that could have been exposed, including your email, Microsoft 365 or Google Workspace, cloud storage, CRM, social media, and any banking or payment platforms.

Start with your email account, as this is typically the most valuable target. With access to your inbox, an attacker can reset passwords for every other account linked to it, making it the master key to your entire digital life.

Creating Strong Passwords
When resetting, don’t just add a number or symbol to your old password — create something entirely new. A strong password should be at least 12–16 characters long and include a mix of uppercase and lowercase letters, numbers, and symbols. Avoid using real words, names, dates, or anything that could be guessed from your social media profiles.

A good approach is to use a passphrase — a string of four or more random words joined together. These are long enough to be secure but easier to remember than a random string of characters.

Use a Password Manager
Rather than trying to remember complex unique passwords for every account, use a password manager such as Bitwarden, 1Password, or the built-in options in Microsoft Edge or Google Chrome. These tools generate and store strong passwords securely, meaning you only need to remember one master password.

Never Reuse Passwords
If you use the same password across multiple accounts and one is compromised, every account sharing that password is now at risk. Each account should have a unique password — full stop.

Step 4: Enable MFA to Secure Accounts

Once a phishing link has been clicked, one of your biggest risks is that an attacker now has — or is attempting to gain — access to your accounts. Multi-Factor Authentication (MFA) is one of the most effective ways to stop them in their tracks, even if your password has already been compromised.

MFA works by requiring more than just a password to log in. A second (or third) verification step means that even if a criminal has stolen your credentials, they still can’t get in without also having access to your phone, email, or authentication app. Common MFA methods include:

• Authenticator apps (such as Microsoft Authenticator or Google Authenticator) — the most secure option, generating a time-sensitive code on your device
• SMS or email codes — a one-time code sent to your mobile or inbox each time you log in
• Biometric verification — fingerprint or face recognition, often used on mobile devices
• Hardware security keys — a physical USB device that must be present to log in, used in high-security environments

If MFA isn’t already enabled across your business accounts — email, cloud storage, banking, CRM, and remote access tools — now is the time to set it up. Microsoft 365 and Google Workspace both have straightforward MFA options built in, and your IT team can roll these out across the whole organisation quickly.

MFA alone can block over 99% of account takeover attacks, making it one of the simplest yet most powerful security measures your business can implement.

Step 5: Check For Any Damage and Strengthen Your Defences

Once the immediate threat has been contained, it’s time to assess the damage and make sure your systems are clean. This step is about both remediation — fixing what’s been affected — and resilience, making sure it can’t happen as easily again.

Run a Full Security Scan
Use your endpoint security or antivirus software to run a thorough scan of the affected device. A good security tool will identify any malware, spyware, or ransomware that may have been silently installed and remove it from your system. If your business doesn’t currently have endpoint protection in place, this is something your IT provider should prioritise immediately.

Audit Installed Apps and Browser Extensions
Check your device for any applications or browser extensions you don’t recognise — these can be installed without you noticing and used by attackers to monitor your activity, log keystrokes, or maintain a backdoor into your system. Delete anything unfamiliar, and if you’re unsure, ask your IT team to review it.

Review Account Activity
Look back through your email sent folder, any connected cloud accounts, and financial systems for unusual activity — such as emails you didn’t send, files that have been accessed or moved, or logins from unfamiliar locations. Many platforms like Microsoft 365 and Google Workspace have audit logs your IT team can review in detail.

Schedule Regular Penetration Testing
Penetration testing — where ethical hackers attempt to break into your systems to find weaknesses before real attackers do — should be a routine part of your cybersecurity strategy, not just a one-off after an incident. Regular testing helps you stay ahead of evolving threats, meet compliance requirements, and give your team and clients confidence that your defences are up to scratch.

Keep Everything Updated
Ensure your operating systems, software, and security tools are all running the latest updates. Many cyberattacks exploit known vulnerabilities in outdated software — keeping everything patched is one of the simplest and most effective defences available.

Phishing attacks are becoming more sophisticated by the day, but acting quickly and following these five steps can significantly reduce the damage to your business. The best time to put proper protections in place, however, is before an attack happens — not after.

Not sure if your business is adequately protected? Digital Orchard IT can help. Book a free consultation today and let’s make sure you’re covered.