If something is happening right now.

First steps

1. Disconnect, do not switch off. Unplug affected computers from the network or turn off Wi-Fi. Leaving them powered on preserves evidence.
2. Do not pay or reply to any ransom demand until you have taken advice.
3. Change passwords from a clean device, starting with email and administrator accounts, and check that MFA is on.
4. Call your insurer if you have cyber cover. Many policies include an incident response helpline and expect you to use it.
5. Write down what you see: messages on screen, times, which machines are affected.

If you are a Coffee Cyber customer

• Complete plan: CrowdStrike's response team may already be acting. Check your email and your Falcon console for their notes.
• Defend and Defend Plus: isolate affected devices from your Falcon console (Host management, Network contain), then raise an urgent request in your control panel.

Report it

• Action Fraud on 0300 123 2040 to report cyber crime in England, Wales and Northern Ireland.^[1]
• The NCSC for significant incidents.^[2]
• The ICO within 72 hours if personal data may have been affected and the breach is reportable.^[3]