Recover from an attack

Emergency incident response

If you're under attack right now, get specialist help in. Contain the attack, find out how it happened, and get back up and running.

Ask us about this
If it's happening now
  1. Disconnect affected machines from the network, but leave them switched on if you can.
  2. Don't contact the attackers, and don't wipe or rebuild anything yet.
  3. Call for help. Contact us, or if you can't reach us, Sophos's UK emergency line on +44 1235 635329.
  4. Tell your cyber insurer early. Many policies require it, and some name the responders you have to use.
The risk

In the first hours of an attack, decisions made in a hurry can make things worse: wiping machines destroys the evidence of how the attacker got in, and systems restored without closing that door can be hit again.

Most businesses have never dealt with an incident before, and it's not the time to learn.

What it does
  • Specialist incident responders available 24/7, whether or not you are already a customer
  • Contains and removes the attacker, then watches for signs they come back
  • Finds out how they got in, so the same way in can be closed
  • Checks how far the attack reached, with compromise assessment and threat hunting
  • Support with ransom negotiation, if it comes to that

There's more on what to do for ransomware, business email compromise, a network intrusion or a forensic investigation.

Who it's for

Any business dealing with an attack right now. MDR Plus customers already have full incident response included.

How we supply it

Emergency response is carried out by Sophos's incident response team and arranged through us. Contact us and we'll get it started. If you can't reach us, you can call Sophos's UK emergency line directly on +44 1235 635329.

What's under the hood

Sophos Incident Response Services — Sophos's digital forensics and incident response team, available to customers and non-customers alike.

Questions
Ransomware, business email compromise, network intrusions and other attacks, with a full forensic investigation where you need to know exactly what happened.
No. Emergency response is available to anyone.
That's your decision, and it may involve your insurer and legal advice. The responders can help you understand the options, and what paying would and wouldn't get you.
It depends on the size of the incident, and the cost is agreed with you before work starts.

← Back to Recover from an attack

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you — no obligation, and no jargon.

Talk to us →
or
See every security area →