Monitoring shows large volumes of data leaving a file server for an unfamiliar external host, and the transfer is still in progress. What should the incident response team do FIRST?

Active exfiltration is ongoing harm, so the first priority is to stop it. Blocking outbound connections to the destination host at firewalls, proxies or other egress points halts the transfer and limits how much data is lost, while the server remains available for evidence collection and scoping. Further containment, such as isolating the server and investigating how the attacker gained access, follows immediately. Allowing the transfer to finish in order to understand its extent sacrifices more data for information that can usually be obtained from logs, flow records and the server itself; deliberately permitting continued loss is rarely defensible. Notifying every customer at this stage is premature: the data involved and the people affected are not yet known, and notification obligations should be assessed with legal counsel on the basis of facts. Forcing an organization-wide password reset may be part of later remediation if credentials are implicated, but it does not stop a transfer already under way from a compromised server and causes significant disruption without targeting the cause. Exam caveat: attackers may switch destinations, so blocking one host is an immediate step, not the full containment strategy. Operational check: confirm the block took effect, review egress logs for other destinations and preserve flow records for the investigation.