If a compromised system contains sensitive data:

• Immediately report the incident
• Do not attempt to investigate or remediate the compromised system yourself
• Do not power down the machine
• Instruct any users to stop work on the system immediately
• Remove the system from the network by unplugging the network cable or disconnecting it from the Wi-Fi network

See Report an IT Security Incident for additional details.