Something is wrong right now?
Tell us first, then protect the evidence
Send us an urgent email and we will call you back. While you wait, work through the checklist below. Most damage after a ransomware attack comes from steps taken in a hurry.
Send us an urgent email
The button opens an email with the subject and a short form already filled in: company, a phone number for a call back, when you first noticed it, how many machines seem affected, whether there is a ransom note, and what you have done so far.
As of 2026.11.07 · For the full service (general availability targeted for 2027) our target is a call back within 30 minutes and remote first response within 2 hours, to be fixed in the contract. Before launch we take reports by urgent email and reply as soon as the on-duty person reads it.
Eight first steps
when you suspect ransomware
Tick them off as you go.
Above all, do not destroy evidence.
After you send the email
- 01Call back
We call the number in your email to understand what you are seeing and what has been done.
- 02Contain
We agree on what to isolate first and how to keep evidence intact.
- 03Investigate
We work out how the attacker got in, what they touched and whether data left the network.
- 04Recover and close
We help restore systems, close the entry point, and prepare the reports regulators and management need.
Scope, people and pricing for incident response are agreed per case. See incident response services.