Emergency incident response
If you're under attack right now, a specialist incident response team can step in to contain it, find out how it happened and get you running again.
More detailsRansomware, a hacked mailbox or an intruder on your network. Get specialist help to contain it, find out what happened and recover, and be ready before it happens.
Under attack right now? Disconnect affected machines from the network but leave them switched on, don't contact the attackers, and call us on 0330 520 4337 (or message us). If you can't reach us, call Sophos's UK emergency incident response line on +44 1235 635329. Help is available whether or not you're already a customer.
Each kind of attack needs a different first response. The pages below explain what to do in the first hour, what specialist responders do, and how to be ready next time.
If you're under attack right now, a specialist incident response team can step in to contain it, find out how it happened and get you running again.
More detailsFiles encrypted and a ransom note on screen? Specialist responders can contain the attack, find out what was taken and help you recover safely.
More detailsA hacked mailbox, a fake invoice or a payment sent to the wrong account? Lock the attacker out, find out what they saw and sent, and close the way back in.
More detailsSigns that someone is inside your network? Find out who, how they got in and what they've touched, then remove them and close the way back in.
More detailsNeed to know exactly what happened? A forensic investigation works out how an attack unfolded, what was accessed and what was taken.
More detailsA plan, a retainer and a rehearsal, so if the worst happens you already know who to call and what to do in the first hour.
More detailsTell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.
Talk to us
or
See every security area
Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us
