You've been hacked - Ten Important Steps to take for Recovery

Below are ideas that might help on "what to do" if your web servers are compromised:

1. Isolate immediately to prevent further damage (unplug servers from Internet)
2. Identify the intruder (based on Firewall logs)
3. Preserve any evidence (swap out hard drives or take a good backup)
4. Report to authorities (usually starting with local police or FBI)
5. Identify vulnerability (why did this happen)
6. Assess potential damage (e.g., accounts, altered web pages, data compromised, perform a thorough AV scan, etc.)
7. Always Rebuild the system from scratch
8. Change all passwords and thoroughly assess file shares and security permissions
9. Return systems back to operation
10. Closely monitor the returned web environment (as crackers or hackerss may try to return - but usually don't once discovered)