Incident response hotline
Dealing with an active cyber incident?
Call our incident line now. The sooner we start, the more evidence survives and the more options you have.
While you wait
First steps that protect your options.
These are general guidelines. Every incident is different, so follow the advice of your responders once they are engaged.
- 01
Do not wipe, reimage or rebuild affected systems.
It destroys the evidence needed to understand what happened and whether the attacker is still inside.
- 02
Disconnect affected machines from the network, but leave them powered on where you can.
Memory holds evidence that is lost at shutdown. If ransomware is actively encrypting files, cutting power may be the lesser harm, so use your judgment.
- 03
Preserve logs now.
Firewall, VPN, identity provider, email and EDR logs often roll over within days. Export them or extend retention right away.
- 04
Move to out-of-band communication.
If email or chat may be compromised, coordinate by phone or through a separate system the attacker cannot see.
- 05
Call your cyber insurer and legal counsel.
Many policies require prompt notice and a response firm from an approved panel. Counsel can help keep the investigation privileged.
- 06
Do not contact the attacker or pay a ransom yet.
Any decision about communication or payment needs legal advice, sanctions screening and expert input.
- 07
Write down what you know.
Note what was seen, when, by whom and what has been done since. Accurate times matter later.
On the call
What we will ask you.
- Your name, role and organization
- A callback number that does not depend on affected systems
- What you are seeing and when it started
- Which systems, accounts or locations seem affected
- Whether you have cyber insurance, and the carrier's name
If anyone's safety is at risk
Call 911 first. You can also report cybercrime to the FBI through the Internet Crime Complaint Center at ic3.gov or by contacting your local FBI field office.
Prepare before the next one
An incident response retainer means the contract, contacts and access are agreed before anything goes wrong.
Learn about retainers