Incident help

Ransomware

Ransomware attack: what to do in the first hour

DC9 Cyber helps companies and institutions contain ransomware attacks: limit their spread, establish how the attacker got in and restore systems safely. We contact you within 60 minutes of receiving your report.

Contact channels

First contact
within 60 minutes of receiving your report
Report an incident

First steps

  1. Isolate infected devices from the network (cable, Wi-Fi, VPN). Do not power them down unnecessarily — if disconnecting is not possible and encryption is spreading, switch the device off.
  2. Cut remote access (VPN, remote desktop) until the situation is assessed.
  3. Protect backups that still work — disconnect them from the network.
  4. Do not contact the criminals or pay the ransom before getting advice.
  5. Write down what was done and when.

Signs

  • files have changed extensions and will not open
  • a ransom note appears on screens or in folders
  • backups have disappeared or are encrypted
  • systems and servers suddenly stop working

Report

Report an incident

A few details are enough for us to get in touch — within 60 minutes of receiving your report.

What you noticed and when, which systems or data may be affected, what has been done so far.

Don’t enter passwords, access keys or login details. Don’t send logs or files — we will agree a separate channel for exchanging material.

We will use the data from your report to contact you about the incident. Privacy policy

or write directly: hello@dc9.io

How we help

  • we establish the scope of the attack and the attacker’s entry point
  • we help cut the attacker off and stop the encryption
  • we check whether data was stolen before encryption
  • we plan system recovery so the attack does not repeat
  • we support management decisions, communication and regulatory notifications

Frequently asked questions

Should we pay the ransom?

Paying does not guarantee you will recover data or that stolen data will not be published. Before deciding, let us check the state of your backups and recovery options.

Can files be decrypted without paying?

Sometimes — for some ransomware families public decryptors exist, for example in the No More Ransom project. We check this at the start of the investigation.

How long until we are back to work?

It depends on the scope of the attack and the state of backups. The first goal is restoring the systems critical to running the business.

Common situations