Do not wipe or rebuild
A reinstalled host is an erased crime scene. Isolate it from the network instead and leave it powered in whatever state it is in.
ACTIVE INCIDENT
Containment starts with one phone call.
If you are being extorted, your data is on a leak site, or something is running on your estate that you did not put there, call the escalation line. It is answered by an operator, not a form queue.
Use a device and an account you have reason to believe are clean. If you suspect your mail is being read, use the WhatsApp line rather than writing to us.
BEFORE YOU CALL
Four things that decide how much we can recover. Start on them now.
Preserve the logs
Stop log rotation where you can, and copy authentication, proxy, VPN and endpoint logs somewhere the attacker cannot reach.
Write a timeline
Who noticed what, at what time, and what has already been changed since. Rough notes are worth more than a perfect report written later.
Keep the circle small
Decide who needs to know before the news travels. If the attacker still has access, an internal announcement is an announcement to them too.
HOW THE CALL GOES
Triage call
What you are seeing, what is already contained, and what is still exposed. No sales conversation on this call.
Authorisation
An NDA and a written authorisation for the systems we are about to touch. This is the point at which scope and fee are agreed.
Containment support
We work alongside your team on a shared channel: identify the foothold, cut the access paths, and confirm what the attacker reached.
Written record
A report you can hand to a regulator, an insurer or a board: what happened, what was touched, what was done, and what is still open.
HAVE READY IF YOU CAN
Network diagramAsset inventoryIdentity providerEDR console accessBackup statusRansom note or extortion mailRegulator deadlinesNamed decision maker
SCOPE OF THIS PAGE
Incident response is a paid engagement under a signed authorisation, and it is not a substitute for reporting a crime to the authorities or for the notification duties your own regulator places on you. The escalation line is for triage and for getting work started quickly; it is not a monitoring service and it does not watch your estate for you.
Reporting a flaw in our own systems? Use responsible disclosure instead.