What's your actual first move in the first five minutes after realizing you've been hacked?

Not the textbook incident-response checklist, the real, gut-reaction first move.

Do you disconnect from the internet immediately? Change passwords from a different device? Call someone? Just sit there for a minute in denial before doing anything? 😅

I've noticed most advice online is written for security teams with a whole process already in place, but almost nobody explains what an individual or a small business owner should actually do in that first panicked moment. Trying to get a sense of what people really do, versus what they think they're supposed to do.