The answer depends on who you are, and what the attacker is accessing. If you're a home user afraid of losing your banking passwords or credit card numbers, yes, disconnect. If you're an internal corporate investigator trained in capturing forensic evidence, and the attacker is caught poking around your systems, you'll probably start by filing an incident and begin tracing their activity.
However, if the system the attacker is accessing contain databases of your customers' federally protected information (GLBA, HIPAA, FERPA, COPA, etc.) or their financial information covered by PCI regulations (credit card numbers, etc.), you should probably contact your local FBI office and ask for their computer crimes unit. In the absence of any other response plan, I would do this immediately while the crime is underway, but in any case you'll likely be required to report it to them within 24 hours of discovery. They should provide you with the appropriate response, which might include "do nothing for two hours while we send someone to investigate".
Most importantly, your response should be determined in advance and written into an info security policy in conjunction with your corporate attorney's advice. Maybe you'll decide to place an investigating firm on retainer, and use them as your first contact (in order to avoid bad publicity regarding contacting the FBI if they determine the attacker did not access the protected data.) But it's important to plan this in advance - if an attack happens at midnight, your admin's first response is likely not to call the attorney for advice.