Start here
Disconnect affected devices from network connections to reduce further spread, while preserving details that may help investigation.
What to look for
Do not erase systems or overwrite backups before the incident scope and recovery approach have been evaluated.
Protect your information
Use an unaffected device to contact the business owner, IT provider and applicable response partners. Preserve relevant messages and times.
When to seek help
Restoration is a separate step from containment; recovered systems should be reviewed for the original access path.
This guide is general information, not a substitute for diagnosis of a specific device or network.
Request Technical Help →