Incident response

Under attack? We can help.

Call us now, or send the priority form below and our incident response team will contact you. We respond between 7 AM and 7 PM Eastern Time.

Call (800) 658-1846 Send the priority form

Priority incident report

Use a phone number and email address that aren't on the affected systems, if you can.

Full name

Organization

Best phone number

What's happening?

Is the attack still happening?

Yes No / not sure

Describe what you're seeing

When it started, which systems are affected, and anything you've already done. Don't include passwords or classified information.

General first steps that help an investigation. Our responders will give you specific advice.

Disconnect affected systems from the network (unplug or disable Wi-Fi), but leave them powered on.
Preserve logs, alerts and any ransom notes or suspicious emails.
Communicate out of band, by phone or on devices you trust.
Write down a timeline of what you noticed and when.