Been hacked? We’ll help you take back control.

Disconnect the affected computers from the network by unplugging the cable and turning off Wi-Fi, but leave them powered on. Don’t reply to the attackers or pay. Take a photo of the ransom note with your phone, then call us. If you have cyber insurance, call your insurer as well.

From a trusted computer or phone, change that account’s password as soon as possible. Phone your important contacts, especially anyone you invoice or pay, to warn them; don’t email them from that account. Then call us. Attackers often leave behind hidden forwarding rules and signed-in sessions that a password change alone doesn’t remove, and we check for them. This is often business email compromise.

Call your bank immediately: the sooner they know, the better the chance of stopping or recalling the payment. Report it to your local police. Confirm any banking change by calling the supplier on a number you already have. Then call us. Fake invoices usually come from a compromised email account, either yours or your supplier’s. We gather the evidence of how the emails flowed, which your bank, insurer and police may ask for, and secure your side so it can’t happen again the same way.

Call your bank immediately and ask them to secure the account. From a trusted computer or phone, change your online banking password and the password of any email account linked to it. Report it to your local police. Then call us, and we’ll find out how the attacker got access, whether through a compromised email account, a stolen password or an infected computer.

Disconnect that computer from the internet. Don’t type any passwords on it, and don’t call a phone number shown on screen; pop-ups that ask you to call are a common scam. If someone was given remote access, note who and when. Then call us before using that computer again.

From a trusted computer or phone, change that person’s password as soon as possible, starting with email. Then tell us what was clicked and when. Reporting quickly matters far more than whose fault it was, and staff who speak up early save everyone time.

No. Anyone dealing with an attack is welcome to call. If you are already a managed client, incident response is included in your plan, so contact us the way you normally would and we’ll start right away.

That’s our expectation, and we’d rather say so now. Our business is managed IT, not one-off fixes. A business that has been attacked needs its security looked after long term, and we can only stand behind systems we manage ourselves. We’ll talk about this on the free phone call, before any work begins, and we may decline if a business isn’t looking for an ongoing managed relationship.

We don’t share the work with another IT provider on the same systems, because split responsibility leaves gaps nobody owns. We may also stop work at any point if we can’t get the cooperation we need, or if we find signs of fraud inside the business.

Call anyway. A quick phone assessment is free, and if it turns out to be nothing, that’s a good outcome. Calling early, while a problem is still small, is always better than waiting to be sure.

A quick phone assessment is free. If your situation needs more work than that, it’s billed on time and materials, and we’ll talk through the cost on the phone before we start. Every incident is different, and paying for the work actually done is the fairest way for both of us. This is emergency security help only; we don’t offer general hourly IT support. For managed clients, incident response is included in their plan.

Our phone line is answered Monday to Friday, 8:00 to 4:30. Outside those hours, submit a ticket and an engineer will respond as soon as possible. In the meantime, work through the steps above: disconnecting affected computers is the most useful thing you can do.

We don’t work that way. We have a no-blame policy: attackers are skilled, and good people click convincing emails every day. What matters now is getting control back. Staff who feel safe telling us what happened help us fix it faster.

Both. There’s no fixed rule: we use our judgement and do whatever gets control back fastest, which is often a mix of the two.

You get a written report of what happened, what we did and what still needs fixing. Then we move your systems onto a managed plan, with managed cybersecurity monitoring them around the clock, so the same attack can’t simply happen again. The report is yours to keep, and it’s a good starting point for an incident response plan.