For legal professionals, the latest widespread ransomware attack hits close to home. DLA Piper offices across Europe and the United States were crippled by ransomware in what was the first publicly acknowledged law firm victim of the attack. It is too early to tell if DLA Piper is the only firm to be affected, but its breach speaks to a broader vulnerability law firms across the globe face against increasingly sophisticated cyber threats.

And while many law firms are building out their cybersecurity defenses, it is far from clear whether they will be ready once an attack happens. It is often the steps taken post-breach that can most limit a law firm’s damages, but what exactly do those steps include? Here is a look at some of most important actions law firms should take immediately following a cyberattack:

1. Hire experts to understand the extent of the damage.