Breach in progress?Call us now.
Ransomware, a hijacked mailbox, or money moving where it shouldn't. Every minute widens the damage. Our incident team starts with containment, then recovery.
What you do now shapes how fast you recover.
Do
- Call the emergency line before anything else
- Unplug affected machines from the network, but leave them powered on
- Photograph ransom notes and error messages
- Talk on a phone or device you know is clean
- Tell your cyber insurer early; many policies require it
Don't
- Wipe, reimage or "clean up" machines on your own
- Contact the attackers or agree to pay
- Reset passwords from a machine that may be compromised
- Delete suspicious emails or logs; they're evidence
- Announce it publicly before you know the scope
If you see any of these, treat it as active.
- Files renamed or encrypted, or a ransom note on screen
- A vendor or executive asking to change payment details
- Sign-ins from places your team has never been
- Admins locked out, or admin accounts nobody created
- A bank, customer or law enforcement reporting a breach
- An outage that looks deliberate, not like normal IT trouble
Contain. Recover. Harden.
- 01
Contain
Confirm what's happening, cut off the attacker's access, and stop it spreading across devices, email and accounts.
- 02
Recover
Remove every foothold, restore from clean backups, and bring the business back in priority order.
- 03
Harden
Close the path they used and give you the report your insurer, lawyers and customers will ask for.
Quick answers while you call.
Do we have to be a client to call?
No. Call either way and tell us you have an active incident.
Should we pay the ransom?
Don't decide yet. Contain first and bring in your cyber insurer and legal counsel. Paying can carry legal risk, and clean backups often make it unnecessary.
Who else should we notify?
Your cyber insurer, your lawyer, and the FBI through IC3 (ic3.gov). Customer and regulator notices depend on what data was involved, and we help you work that out.
What happens after the attack is contained?
You get a written report of what happened and what changed, and the option to keep 24/7 monitoring in place so it doesn't happen again.