Something’s happening right now.
Breathe. Most incidents are recoverable. Do these in order — then report below.
First hour — do these, in order
- Unplug the affected machine from the network. Network cable out, or Wi-Fi off. Don’t shut it down — evidence lives in memory.
- Don’t pay, don’t click, don’t reset. Attackers count on panic. Paying or “cleaning up” before triage makes it worse.
- Delete nothing. Logs, pop-ups, emails — all evidence. Hold every antivirus wipe until we’ve looked.
- Write down what you saw, and when. Times, screens, messages, accounts. Screenshots help.
- Money moved? Call your bank first. Wire fraud has a minutes-long window. Bank first, report second.
Now tell us — 60 seconds
I’m an intake bot, not a person. Everything you tap goes straight to a human, and you get a call back — same day on business days.