Suspect an active cyber incident?
Do these 5 things →Contact the Rovyren Team →
ROVYREN
Incident response

What to do if you’ve been compromised.

Move quickly, but do not improvise. Contain the incident, protect money and accounts, preserve evidence, and bring in qualified help.

If anyone is in physical danger, call 911.For an active cyber incident, use a known-clean phone or device to contact your IT/security provider, cyber insurer, legal counsel, financial institution, and appropriate law enforcement. Do not communicate incident details through an account or device you believe is compromised.
Start here

Do these 5 things if you suspect a compromise

Use a known-clean phone or device. Start containment immediately and have another trusted person make urgent calls in parallel when possible.

  1. Contain the problem and preserve evidence.

    Disconnect affected devices from Wi-Fi, Ethernet and VPN. Avoid rebooting, wiping, deleting files or reconnecting backups. Power down only if you cannot isolate the device and must stop the spread. Record what you noticed and the actions taken; keep messages, logs and ransom notes.

  2. Call your insurer.

    Use the cyber-insurance claims or breach hotline on your policy; if you are unsure of coverage, contact your insurer or broker. Report the suspected incident promptly, ask about required notices, approved responders and authorization for costs, and record the claim number. Do this before hiring outside responders or approving recovery expenses when feasible, without delaying urgent containment. Coverage depends on your policy.

  3. Protect accounts and money.

    If a payment, wire, payroll or bank change may be involved, call your bank or payment processor immediately using a verified number and request a freeze or recall. Pause payment changes. From a clean device, work with IT to disable affected accounts, revoke sessions and reset exposed credentials; prioritize email, administrator, banking and payroll access.

  4. Bring in qualified help.

    Contact your IT/security provider and the insurer-approved incident responders, and involve legal counsel. Use a separate, trusted communication channel. Give responders the timeline and evidence; let them coordinate investigation and recovery. Rovyren’s website and booking email are not an emergency dispatch service.

  5. Report the incident and recover under a plan.

    Report suspected cybercrime to the FBI at IC3.gov and appropriate law enforcement. Have counsel assess customer, employee and regulator notification duties promptly. Reconnect systems or restore backups only after qualified responders confirm the cause is contained and the recovery path is clean. Avoid paying a ransom or negotiating without qualified legal and insurer guidance.

General first-response guidance. Follow your incident plan and qualified responders’ instructions; exact actions depend on the incident. Physical danger: call 911.

Detailed response guidance

First 15 minutes

Stop the spread

  1. Disconnect affected computers and devices from Wi-Fi, Ethernet, VPN, and shared drives.
  2. Do not wipe, reimage, or delete suspicious files, emails, logs, or ransom notes.
  3. If a device cannot be isolated from the network, power it down only as a containment measure.
  4. Move incident coordination to a known-clean device and separate communication channel.
First hour

Protect accounts and money

  1. From a clean device, disable affected accounts, revoke active sessions, and secure administrator, email, payroll, banking, and accounting access first.
  2. Contact the bank or payment processor immediately if transfers, payroll, cards, or vendor-payment changes may be involved.
  3. Pause payment-change requests and independently verify any recent banking or direct-deposit changes.
  4. Contact the cyber insurer before committing to outside vendors when policy approval may be required.
Same business day

Preserve facts and activate help

  1. Record when the incident was noticed, what happened, affected people and systems, and every containment action taken.
  2. Preserve original emails, headers, screenshots, phone numbers, wallet addresses, ransom notes, and system logs.
  3. Engage qualified incident-response, legal, insurance, and IT professionals to determine scope and notification duties.
  4. Report appropriate cybercrime to the FBI’s Internet Crime Complaint Center at IC3.gov.
Recovery

Restore carefully

  1. Do not reconnect systems until the cause is contained and credentials, persistence, and vulnerabilities are addressed.
  2. Restore only from backups that responders determine are clean and uncompromised.
  3. Monitor email, bank, payroll, cloud, and administrator accounts for continued unauthorized activity.
  4. Complete customer, employee, regulator, insurer, and law-enforcement notifications under qualified legal guidance.
CISA: I’ve Been Hit by Ransomware ↗FBI IC3: Ransomware Response ↗FTC: Data Breach Response for Business ↗

Do not create a second incident.

Rushing to reset, wipe, restore, or reconnect everything can destroy evidence, spread malware, or lock responders out of information they need. Contain first, then recover under a controlled plan.

Do these 5 things →