Is your company under a cyber attack?
First, disconnect the affected machines from the network and do not delete anything. Then tell us what is happening using the form. The steps for the first few hours are below.
Email: [email protected]
Tell us about the incident
The more specific, the better: what you have seen, since when, and what is affected.
What to do in the first hours
- 1
Isolate the affected machines
Disconnect them from the network, both wired and Wi-Fi. Avoid shutting them down unless you can see the encryption is still spreading: memory holds evidence that is useful for the investigation.
- 2
Do not delete or reinstall anything
Keep logs, suspicious emails, ransom notes and screenshots. Reinstalling before investigating destroys the clues about how the attackers got in.
- 3
Put one person in charge and write everything down
One person coordinates and makes the decisions. Write down, with the time, everything you observe and every action you take.
- 4
Coordinate through a secure channel
If corporate email or messaging could be compromised, use phones or another channel to talk about the incident.
- 5
Change credentials from a clean device
Start with privileged accounts and the accounts involved. Close open sessions and review remote access.
- 6
Check your backups
Make sure they are disconnected and have not been affected before you restore anything. Only restore once you know how the attacker got in.
- 7
Get specialist help
Contact an incident response team, your cyber insurance provider if you have one, and your legal advisers.
What to do by type of incident
- CEO fraud and BEC: how to spot them and what to do if your company has already sent the moneyCEO fraud and BEC are email scams in which someone impersonates an executive or a supplier so your company pays into an account they control. If you've already sent the transfer, call your bank now so it can try to hold the funds, report it to the police and check for a compromised mailbox.
- Compromised Microsoft 365 or Google Workspace account: how to take back controlIf a business account is compromised, block sign-in, revoke all its sessions and change the password from a clean device. Then remove what the attacker may have left to get back in: new MFA methods, forwarding rules, OAuth apps with permissions and app passwords. Finally, review what they read, sent or downloaded.
- Data breach at your company: how to confirm it, contain it and measure its scopeIf you suspect a data breach, first confirm whether it is real and which system the data came from. Then cut off the exit path without destroying evidence, establish what information was exposed, whose it is and since when, coordinate communications with your legal counsel, and watch for the data resurfacing on forums, marketplaces or leak sites.
- An employee fell for a phishing email: what your company should do, depending on what happenedIf an employee fell for phishing, act based on what they did. If they only clicked, check the device and block the domain. If they typed their password, change it from a clean device, end their sessions and review MFA and mailbox rules. If they opened an attachment, isolate the device. Then search other mailboxes for the same email.
- Ransomware attack on your company: what to do in the first hours and how to recoverIf ransomware has encrypted your company's computers, disconnect the affected systems from the network without shutting them down, keep the ransom note and the logs, coordinate the response over a channel outside corporate email, and don't pay or negotiate on your own. Restore from verified backups only once you know how the attacker got in.
What not to do
- Pay the ransom. It does not guarantee you will get your data back, and it marks you as a target for new attacks.
- Negotiate or get in touch with the attackers on your own.
- Reconnect machines or restore backups before you know how the attackers got in.
- Use administrator accounts on machines that could be compromised.
Signs that you are under attack
- Files with strange extensions or a ransom note on your machines.
- Locked accounts, changed passwords or MFA prompts that nobody requested.
- Antivirus or EDR turned off with no explanation.
- Emails sent from your account that you did not write.
- Unusual data transfers or traffic spikes, especially outside working hours.
How Ciberia helps
Contain
We isolate the machines and accounts involved so the attack does not spread.
Investigate
We find the entry point, the scope and whether the attacker is still inside, with Threat Hunting and intelligence from Ciberia Intel.
Recover and monitor
We support you on the way back to normal and, with Ciberia MDR, monitor your environment day and night so it does not happen again.
Would you rather prevent it? Take a look at Ciberia MDR and Ciberia CTM.
Frequently asked questions
What should I do if ransomware has encrypted my company's computers?
Disconnect the affected machines from the network, do not pay the ransom, preserve the evidence and do not restore backups until you know how the attacker got in. Then get help from an incident response team.
Should I shut down infected computers?
The priority is to disconnect them from the network. Shutting them down wipes the memory, which contains evidence, so only do it if the encryption is still spreading and you cannot isolate it any other way.
Is there free public help in Spain?
Yes. INCIBE, Spain's National Cybersecurity Institute, assists businesses and citizens on 017, its free and confidential cybersecurity helpline.
Do you handle incidents for companies that are not clients?
Yes. Tell us what is happening using the form on this page and we will contact you to assess the case and help you contain it.