Everything I.T.

The first 24 hours after a suspected breach decide whether the next six months are manageable or catastrophic.

Most of the damage in those hours comes from actions that feel productive but cost you later. The order that works:

1. Stop. Don't touch infected machines or systems. The forensic evidence on them is what determines whether your insurer covers you and whether you can prosecute later.
2. Call your cyber insurance broker. They will assign you an incident response firm and a breach attorney, often within the hour. Both fees are usually covered by your policy.
3. Call your breach attorney before you call your IT person. The attorney creates legal privilege over everything that follows, which protects you if the incident ends up in court.
4. Let the incident response firm lead. They contain the attack, collect evidence, and advise on ransom decisions. Your job is to authorize the work, not perform it.
5. Notify law enforcement. FBI IC3 at ic3.gov, or your state's cyber unit. Required in some states, helpful in all of them.
6. Don't tell your team, customers, or social media anything until your attorney clears the message.

The first call you make matters more than every action that follows.

In May 2026, Microsoft confirmed that hackers are actively breaking into on-premise Exchange servers using a flaw called CVE-2026-42897.

The attack is simple. A hacker sends a normal-looking email to someone on your team. They open it in the browser version of Outlook. Hidden code in the email runs. The hacker is now inside your network. Your employee doesn't have to click anything. Just reading the email is enough.

It hits Exchange 2016, 2019, and Subscription Edition. The cloud version (Exchange Online in Microsoft 365) is safe. CISA gave federal agencies until May 29, 2026 to patch this, which tells you how serious it is.

If you don't know whether your business runs Exchange on a server in your office or in Microsoft's cloud, ask your IT person today. If the answer is on-prem, install Microsoft's May 2026 update and turn on Exchange Emergency Mitigation Service (EMS) until the update is fully done. If you've been putting off the move to the cloud, this is your reason to do it now.

Your email server is the front door to your business. Right now thousands of them are unlocked.

On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email CVE-2026-42897 is exploited in on-prem Exchange; crafted emails enable spoofing, forcing urgent mitigation.