Creative IT
020 7394 2529Report an incident

RANSOMWARE RESPONSE / STEP 03

Compromise Assessment

Not every incident starts with a ransom note. Sometimes it's a strange login, an unexplained process, or a warning from a third party — and you need to know whether you've actually been compromised before deciding what to do next.

01

Review logs and access history

We check authentication logs, remote-access history and account activity for signs of unauthorised access.

02

Inspect endpoints for malware

We look for malware, backdoors and persistence mechanisms on affected or suspect systems.

03

Check for data exfiltration

We look for signs that data was copied or transferred out, not just accessed — relevant to any notification obligations you may have.

04

Build a timeline

Where we find evidence of compromise, we put together a timeline of what happened and when, so you know the actual scope rather than a worst-case guess.

This is often the right starting point when you're not sure whether you've been breached at all, rather than jumping straight to a full incident response. Start a case on the contact page, or see the full ransomware response overview.

THE REST OF OUR RANSOMWARE RESPONSE

Also covered

01

Rapid Triage & Containment

We help isolate affected systems and stop the spread while we assess what's actually been encrypted or destroyed.

02

Ransomware Data Recovery

Recovering encrypted files from shadow copies, partial backups, unaffected volumes and the encrypted data itself, wherever possible — often without paying the ransom.

04

Post-Incident Hardening

Once you're recovered, we help close the gap that let it happen — backups, access controls and monitoring.