IT ISSUE · SECURITY AND THREATS
Ransomware concern
Files encrypted, or a ransom message. Work through the immediate steps below, then bring in the people this needs alongside us.Almost everything that decides how this goes was settled before today. Whether a backup exists that the same credentials couldn't reach, whether anybody has restored from it, and how quickly the spread can be stopped. Those are preparation, not response.
Immediate practical steps
- Disconnect affected machines from the network, but do not wipe them.
- Do not pay anything, and do not reply to the message.
- Tell whoever manages your backups to pause them, so good copies aren't overwritten.
- Write down what you saw and when, before memories blur.
- Contact your insurer early if you have cover.
What we do, and what needs specialists
We help with the immediate containment we're permitted to perform, assess what is affected and work on restoring service from whatever clean copies exist.
We aren't an incident response or forensic investigation firm, we don't negotiate with anybody, and we don't handle breach notification. An incident of any seriousness needs a specialist, your insurer and usually a legal adviser, and we'd rather bring them in on day one than after a week of us doing our best.
If you are reading this and it hasn't happened, the useful question is whether a backup exists that today's credentials can't delete.