If you believe your business is under attack, what you do in the first minutes decides how bad it gets. Follow these steps in order.
Do this now
- Call the emergency line: +44 (0) 20 3468 1714. Our rescue team will talk you through containment step by step.
- Tell whoever else may be affected (colleagues on the same network) to stop working on shared files.
- Note the time and what you observed - unusual files, messages, pop-ups - for the investigation.
Do NOT do this
- Do not shut down or reboot affected systems. This can destroy evidence and can be part of what the attacker wants.
- Do not pay a ransom. Paying does not guarantee your data returns and funds the attackers. There is no negotiation involved - call us instead.
- Do not disconnect everything blindly. Wait for our guidance so we can preserve evidence and avoid breaking recovery paths.
- Do not delete files or change passwords on your own. Some of these actions overwrite evidence that tells us how they got in.
Remember
You will not get in trouble for reporting a suspected attack. The faster you call, the more likely we can contain it, recover your data and keep your business running.
