Recover from an attack

Emergency incident response

If you're under attack right now, get specialist help in. Contain the attack, find out how it happened, and get back up and running.

Ask us about this
If it's happening now
  1. Disconnect affected machines from the network, but leave them switched on if you can.
  2. Don't contact the attackers, and don't wipe or rebuild anything yet.
  3. Call for help. Call us on 0330 520 4337, or if you can't reach us, Sophos's UK emergency line on +44 1235 635329.
  4. Tell your cyber insurer early. Many policies require it, and some name the responders you have to use.
The risk

In the first hours of an attack, decisions made in a hurry can make things worse: wiping machines destroys the evidence of how the attacker got in, and systems restored without closing that door can be hit again.

Most businesses have never dealt with an incident before, and it's not the time to learn.

What it does
  • Specialist incident responders available 24/7, whether or not you are already a customer
  • Contains and removes the attacker, then watches for signs they come back
  • Finds out how they got in, so the same way in can be closed
  • Checks how far the attack reached, with compromise assessment and threat hunting
  • Support with ransom negotiation, if it comes to that

There's more on what to do for ransomware, business email compromise, a network intrusion or a forensic investigation.

Who it's for

Any business dealing with an attack right now. MDR Plus customers already have full incident response included.

How we supply it

Emergency response is carried out by Sophos's incident response team and arranged through us. Call us on 0330 520 4337 and we'll get it started. If you can't reach us, you can call Sophos's UK emergency line directly on +44 1235 635329.

What's under the hood

Sophos Incident Response Services - Sophos's digital forensics and incident response team, available to customers and non-customers alike.

Questions
Ransomware, business email compromise, network intrusions and other attacks, with a full forensic investigation where you need to know exactly what happened.
No. Emergency response is available to anyone.
We never recommend paying. There's no guarantee it gets your systems or data back, it funds the criminals, and the NCSC and UK law enforcement don't condone it. The responders will work with you to recover without paying.
It depends on the size of the incident, and the cost is agreed with you before work starts.

< Back to Recover from an attack

Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

Talk to us
or
See every security area

Our experts spent 20 years at Sophos and include a certified ethical hacker.
More about us

Ask us about this