Emergency incident response
If you're under attack right now, a specialist incident response team can step in to contain it, find out how it happened and get you running again.
More details →
Ransomware, a hacked mailbox or an intruder on your network. Get specialist help to contain it, find out what happened and recover, and be ready before it happens.
Under attack right now? Disconnect affected machines from the network but leave them switched on, don't contact the attackers, and contact us. If you can't reach us, call Sophos's UK emergency incident response line on +44 1235 635329. Help is available whether or not you're already a customer.
Each kind of attack needs a different first response. The pages below explain what to do in the first hour, what specialist responders do, and how to be ready next time.
If you're under attack right now, a specialist incident response team can step in to contain it, find out how it happened and get you running again.
More details →Files encrypted and a ransom note on screen? Specialist responders can contain the attack, find out what was taken and help you recover safely.
More details →A hacked mailbox, a fake invoice or a payment sent to the wrong account? Lock the attacker out, find out what they saw and sent, and close the way back in.
More details →Signs that someone is inside your network? Find out who, how they got in and what they've touched, then remove them and close the way back in.
More details →Need to know exactly what happened? A forensic investigation works out how an attack unfolded, what was accessed and what was taken.
More details →A plan, a retainer and a rehearsal, so if the worst happens you already know who to call and what to do in the first hour.
More details →Tell us a little about your business and we'll recommend the controls that will work best for you — no obligation, and no jargon.