If a compromised system contains sensitive data:
- Immediately report the incident
- Do not attempt to investigate or remediate the compromised system yourself
- Do not power down the machine
- Instruct any users to stop work on the system immediately
- Remove the system from the network by unplugging the network cable or disconnecting it from the Wi-Fi network
See Report an IT Security Incident for additional details.