Our responders are standing by
24/7 Emergency Cyber Incident Response
Discreet, expert-led incident response. Whether it’s ransomware, data theft, or a suspected breach - we’ll help you take control.
Let's make it happen
Start a conversation that leads to cyber confidence:
UK/Europe: +44-203-693-7480
Africa: +230-434-1277
India: +91-20-68317014
USA: +1-703-232-9015
Your contact details will only be used in connection with this enquiry.
Please read our Privacy Policy.
Response actions include:
Rapid threat containment and forensic triage
Threat actor engagement and negotiation
Secure decryption and recovery support
Legal, insurance, and regulatory coordination
Press & PR coordination
Client and stakeholder communications
Post-incident review and recommendations
What to Do Immediately
Stop the spread. Preserve evidence. Call expert help now.
Follow the steps below for your situation - and call our 24/7 hotline immediately.
-
Disconnect from the network – unplug cables, turn off Wi-Fi, and block internet access to cut off remote control.
-
Keep the device powered on – don’t switch it off or wipe it; this keeps evidence intact.
-
Do not contact or pay the attackers – wait for expert checks (including sanctions checks) before any communication or payment.
-
Save all clues – ransom notes, screenshots, file samples, and system logs.
-
Stop it spreading – turn off shared drives and block any suspicious servers at the firewall.
-
Follow Section: “If Privileged/Admin Access May Be Compromised”
-
-
Limit access immediately – disconnect affected systems, revoke tokens/API keys, change passwords.
-
Record the evidence – save logs, alerts, firewall data, and server snapshots.
-
Work out what’s at risk – list folders, databases, or storage that may have been viewed or copied.
-
Secure your systems – turn on MFA and ensure it is enforced for all accounts, close open ports, disable accounts you don’t recognise.
-
Involve your legal team – prepare for possible customer or regulator notifications.
-
-
Stop all payments – confirm changes only by calling trusted contacts on known phone numbers. Don’t email as this communication medium may be compromised and will alert the threat actors.
-
Reset passwords from a clean device – log out all sessions, enforce MFA.
-
Remove hidden mail rules – disable forwarding or other mail rules, app passwords, and suspicious settings. If you must delete them record evidence of what they were (e.g. screenshots with all relevant details).
-
Check account access logs – review recent logins, app permissions, and admin changes.
-
Contact your bank – request recall of any suspicious payments.
-
Consider whether you are the party being defrauded/targeted –Threat actors may be targeting an incoming payment from a third party you are dealing with
-
-
Call your bank immediately – request a freeze or recall; report as authorised push payment fraud.
-
Alert the receiving bank – give transaction details to request a hold.
-
Keep all evidence – invoices, emails, chat messages, wallet IDs, and transaction references.
-
Pause other related payments – confirm supplier/third party details by phone.
-
Inform legal and incident response teams – align next steps and preserve evidence.
-
-
Disable and replace access – suspend admin accounts, change keys, and service account credentials.
-
Revoke all active sessions – log everyone out on your identity platform (Microsoft Entra ID, Okta, etc.) and reset MFA. Be careful not to lock out your access.
-
Check admin logs – remove any new or suspicious admin accounts.
-
Limit logins – block risky locations or IP addresses temporarily; enforce MFA for all.
-
Plan wider resets – coordinate password and key changes across systems.
-
-
Reduce access quietly – apply least-privilege rules, disable accounts where appropriate.
-
Preserve evidence – collect logs, device images, DLP alerts, CCTV footage. Ensure evidence is handled with proper chain-of-custody.
-
Coordinate with HR and legal – agree the approach before confronting anyone.
-
Secure sensitive data – lock or relocate high-risk data sources.
-
-
Contact your ISP or CDN – activate “under attack” mode and upstream filtering.
-
Control the traffic – apply rate limits, web application firewall rules, and temporary location blocks.
-
Log all activity – save firewall, load balancer, and CDN records.
-
Communicate updates – keep stakeholders informed without revealing technical details to the public.
-