Immediate containment & incident response.
- 01Do not power the machine off
Memory holds evidence that a shutdown destroys. Disconnect it from the network instead — cable out or Wi-Fi off.
- 02Do not delete anything
Not the suspicious file, not the logs, not the ransom note. Everything is evidence, including the parts that are embarrassing.
- 03Do not pay yet
Paying is a decision with legal and sanctions consequences. It is never the first hour’s decision, and we will walk through it with you.
- 04Assume email is compromised
Coordinate on phones or a separate channel until we know otherwise. Attackers read incident-response threads.
- 05Write down what you noticed and when
Times, screens, who saw it. Rough notes now are worth more than a perfect reconstruction tomorrow.
GDPR gives you 72 hours to notify your supervisory authority. NIS2 gives you 24 hours for an early warning if you are in scope. Those clocks started when you became aware — not when you finish investigating. We will handle both filings with you.
