Creative IT
020 7394 2529Report an incident

RANSOMWARE RESPONSE / STEP 01

Rapid Triage & Containment

The first hour after you spot a ransomware note matters more than almost anything that follows. Our triage call is aimed at stopping the spread and getting a clear picture of what's affected, before any recovery work begins.

01

Initial triage call

We talk through what you're seeing — the note, the affected systems, any early warning signs — and give immediate guidance over the phone.

02

Isolate affected systems

We help you disconnect compromised machines from the network and any shared or cloud-synced storage, to stop encryption spreading further.

03

Scope the incident

We identify which systems, shares and backups have actually been touched, and which are still clean — this shapes everything that follows.

04

Preserve what's recoverable

We advise on what not to do next — don't reboot, don't run generic "fix-it" tools, don't pay before we've assessed it — since any of these can destroy data that was otherwise recoverable.

Triage is usually a phone call first, not a site visit — the faster we can talk to you, the more options stay open. Start a case on the contact page, or see the full ransomware response overview.

THE REST OF OUR RANSOMWARE RESPONSE

Also covered

02

Ransomware Data Recovery

Recovering encrypted files from shadow copies, partial backups, unaffected volumes and the encrypted data itself, wherever possible — often without paying the ransom.

03

Compromise Assessment

Not sure if you've actually been breached? We check for signs of unauthorised access, malware and data exfiltration.

04

Post-Incident Hardening

Once you're recovered, we help close the gap that let it happen — backups, access controls and monitoring.