Skip to main content
Cyber6

URGENT HELP

Think you're under attack? Here's what to do right now.

CALL

(800) 321-2005

Answered 9:00 AM to 5:00 PM Pacific, Monday to Friday. Clients can reach the emergency line any time.

EMAIL

support@cyber6technology.com

For urgent problems, call. Email is checked throughout business hours.

Already a Cyber6 client? Call your direct support line.

What's happening?

Pick the closest match. You'll get the first steps for that situation. If you're not sure, choose the last option.

Files are locked, or there's a ransom note

DO THIS NOW

  1. Disconnect affected devices from the network. Unplug the network cable or turn off Wi-Fi.

  2. Leave them powered on. Don't restart, shut down, or wipe them, because that can destroy evidence.

  3. Take a photo of the ransom note or error screen with your phone.

  4. Call us, then call your cyber insurer if you have one.

DON'T

  • Don't pay, reply to, or contact the attackers.
  • Don't restore from backups yet. Restoring before the problem is contained can bring it right back.

Money was sent to the wrong place

DO THIS NOW

  1. Call your bank immediately and ask them to recall or stop the transfer. Minutes matter.

  2. Report it to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.

  3. Save every related email and message. Don't delete anything.

  4. Change the email password from a device you know is clean, and turn on multi-factor authentication (MFA).

DON'T

  • Don't reply to the email thread that asked for the payment.
  • Don't use contact details from that thread. Use a phone number you already had.

WHO ELSE TO CALL

An email or account was hacked

DO THIS NOW

  1. From a device you know is clean, change the password, starting with email, banking, and admin accounts.

  2. Sign out of all sessions and turn on multi-factor authentication (MFA).

  3. Check for forwarding rules, new recovery emails or phone numbers, and unfamiliar connected apps.

  4. Warn your contacts not to act on recent messages from you.

DON'T

  • Don't change passwords from a computer that might be affected.
  • Don't delete the suspicious emails or rules before we see them.

WHO ELSE TO CALL

  • The account provider's support
  • Your bank, if financial accounts were involved

A device was lost or stolen

DO THIS NOW

  1. If the device is managed, lock it or erase it remotely.

  2. Change passwords for any accounts that were signed in or saved on it.

  3. Write down what data was on it and whether it was encrypted.

  4. Report a theft to local police. Your insurer may need the report number.

DON'T

  • Don't wait to see if it turns up before locking it.

WHO ELSE TO CALL

  • Us — we can confirm encryption and lock or erase managed devices
  • Local police

Private data may have been exposed

DO THIS NOW

  1. Write down what data, whose data, and when you first noticed.

  2. Keep logs, files, and messages as they are.

  3. Call us, and check the reporting deadlines section below. Some deadlines start the moment you find out.

  4. Talk to your attorney before notifying customers or the public.

DON'T

  • Don't delete logs or files to "clean up."
  • Don't make public statements before you know what happened.

WHO ELSE TO CALL

  • Your attorney
  • Your cyber insurer

Something's wrong, but I'm not sure what

DO THIS NOW

  1. Stop clicking on pop-ups, alerts, or links that seem strange.

  2. If more than one device is acting up, disconnect them from the network.

  3. Write down what you saw and when.

  4. Call us. It's fine if it turns out to be nothing.

DON'T

  • Don't call phone numbers shown in pop-up warnings. Those are often scams.
  • Don't let anyone you didn't contact connect to your computer remotely.

Is someone in physical danger or being threatened? Call 911. Outside the U.S., call your local emergency number.

Do you have a reporting deadline?

Some organizations must report an incident within days or hours of discovering it. The clock can start before you know everything.

Federally insured credit unions72 HOURS

The NCUA requires notice within 72 hours after a credit union reasonably believes a reportable cyber incident has occurred.

Defense contractors72 HOURS

Contracts with the DFARS 7012 clause require reporting cyber incidents to the Department of Defense within 72 hours of discovery.

Public companies4 BUSINESS DAYS

SEC rules require an 8-K filing within four business days after the company determines an incident is material.

Non-bank financial businesses30 DAYS

Under the FTC Safeguards Rule, businesses like tax preparers, mortgage brokers, and auto dealers must notify the FTC within 30 days of discovering a breach involving unencrypted information of 500 or more consumers.

Healthcare organizations and their business associates60 DAYS MAX

HIPAA requires notifying affected individuals without unreasonable delay and no later than 60 days after discovery. Business associates must notify the covered entity.

Everyone elseVARIES

Most U.S. states have breach notification laws with their own timing. Your cyber insurance policy may also require prompt notice.

This is general information, not legal advice. Talk to your attorney about what applies to you.

What happens when you call us

  1. 1

    Listen

    We ask what you're seeing and help you stop the damage while we're on the phone.

  2. 2

    Contain

    Affected accounts and devices are isolated so the problem stops spreading.

  3. 3

    Recover

    Systems are cleaned and restored from backups, in an order you agree to.

  4. 4

    Report

    You get a written account of what happened, what we changed, and what to fix next.

WHAT WE'LL ASK YOU

  • Your name and a callback number
  • What you're seeing, and when it started
  • Whether money has moved
  • Whether you have cyber insurance, and who your insurer is

Can't call right now?

Are you a current Cyber6 client?

We use this only to respond. Privacy policy

Want a printable version to keep by the phone? Print the first-hour checklist →

More detail: The first hour of a ransomware attack →

When things are calm again, we can help you prepare for next time →