Under attack? Start here.
This page is for anyone, customer or not. The steps below limit the damage while we get involved. What you do calmly in the first few minutes makes the biggest difference.
Fastest way to reach us
securityPut “URGENT” in the subject line. Tell us what you see, which servers or sites are involved and a phone number we can call.
What to do in the next 15 minutes.
Five steps, in this order. You don’t need any technical background to follow them.
- 1Take a breath, then write down the time.Note when you noticed the problem and what you saw: strange messages, new files, emails you didn’t send. Screenshots help us later.
- 2Disconnect it, don’t switch it off.If a server or computer is affected, cut it off from the network rather than shutting it down. Turning it off can erase the clues that show how the attacker got in.
- 3Change your key passwords from a safe device.Start with your email, your hosting or cloud account, your domain registrar and your bank. Use a phone or computer you trust, never the affected one.
- 4Turn on two-step sign-in.Wherever you can, add a second step, like a code on your phone. A stolen password on its own is then no longer enough to get in.
- 5Tell the people who need to know.Your hosting provider can often see the attack and block it from their side. If customer data may be involved, you may have to report it, so keep your notes.
Three things to hold off on.
- Don’t pay anyone, for any reason, before you have spoken to an expert.
- Don’t wipe or reinstall the affected server yet. The evidence is still on it.
- Don’t announce it publicly until you know what actually happened.
What we will do.
Whether or not you use BurstLayer, this is how our security team works through an attack with you.
Look at what is happening
We read the logs and signs you send us and tell you, in plain words, what kind of attack this is.
Help you stop it
We block the attacker’s addresses, lock the accounts they used and shut the doors they came through.
Find how they got in
An old plugin, a reused password, an open port: we find the way in so it cannot be used again.
Make sure it stays closed
Once things are calm, we can switch on BurstLayer to watch for the same attacker coming back.
Reach us now.
Pick whichever is fastest for you. All three reach the same security team.