What steps should be taken immediately after discovering a DDoS attack on a 'megaphon'?

Immediately after discovering a DDoS attack on a 'megaphon' service, the priority is to activate the DDoS mitigation plan. This involves notifying the IT security team, engaging with the DDoS mitigation provider, blocking malicious traffic sources, scaling up server resources if possible, and communicating with users about the service disruption.