Call +1 (888) 966-7228 — a human answers 24/7/365
Think You've Been Hacked? Do This First.
Take a breath. The next hour matters less for stopping the attacker than for protecting the evidence you'll need - and the right moves are simple.
If you think an incident is happening right now:
- Don't delete suspicious files or emails - they're evidence
- Don't wipe or reimage anything yet
- Don't pay, reply to, or negotiate with anyone before getting guidance
- Do disconnect affected machines from the network instead of powering them down - volatile evidence is lost on shutdown, so pull the network cable or Wi-Fi, not the power, unless disconnecting isn't possible
- Do write down what you noticed and when you noticed it
- Do communicate by phone or a known-clean device - not the possibly-compromised email system
Call +1 (888) 966-7228 before taking further action. A human answers 24/7/365.
The information provided here is for educational purposes only and should not be considered legal advice. Requirements change and applicability depends on your specific circumstances - for specific compliance concerns, consult a qualified legal professional.
Why these steps, and not the obvious ones
The obvious instinct - turn it off, delete the bad thing, clean it up - destroys the record of what happened. A running machine holds volatile evidence in memory: active connections, running processes, the attacker's tools. Power it down and that evidence is gone; disconnect it from the network and the attacker is cut off while the evidence survives. That's why guidance from CISA's #StopRansomware Guide and NIST SP 800-86 says isolate first and treat powering off as a last resort.
The record matters because your recovery isn't only technical. Your insurance carrier, your lawyer, and possibly a regulator will ask what happened, when you knew, and what you did about it. Deleted emails, wiped machines, and undocumented timelines turn those answers into guesses - and guesses are expensive in claims and in notifications.
The same logic drives the last step. If the attacker is in your email, planning your response in that email tells them your next move. Phone calls and a known-clean device keep your response private while it still needs to be.
What happens when you call
A human answers 24/7/365 - the line is staffed around the clock, including weekends and holidays. You don't need to be a customer, and you don't need to be sure it's a real incident.
On that first call you get first-hour stabilization guidance: what to isolate, what to preserve, what to write down, and what to hold off on - the same steps on this page, applied to what's actually happening in your environment.
From there, a DFIR specialist engages within 24 hours to handle containment, forensic investigation, and recovery. You'll know who is doing what before the call ends.
A human answers 24/7/365. A DFIR specialist engages within 24 hours.
Common questions
Do I need to be a WOM customer to call?
No. The number is answered for anyone dealing with a possible incident. If you call, you'll get first-hour guidance either way - who you hire afterward is a separate decision, made calmly, later.
What if it turns out to be a false alarm?
That's a good outcome, and it costs nothing. Confirming that nothing happened is a legitimate result of an investigation, not a wasted call - and finding out early is exactly how small incidents stay small.
Should I pay the ransom?
Don't decide that alone, and don't decide it first. Payment doesn't guarantee recovery, the FBI does not support paying a ransom, and some payments carry sanctions exposure under Treasury's OFAC advisory. This is a decision to make with a response team and counsel involved - call before you respond to any demand.
Who do we have to notify, and by when?
It depends on where the affected people live and what data was involved. Florida puts a 30-day clock on notifying affected residents under F.S. 501.171 - see the Florida notification section on our incident page - and frameworks like HIPAA and PCI DSS add their own requirements. Preserve the evidence first: every notification decision depends on knowing what actually happened.
The information provided here is for educational purposes only and should not be considered legal advice. Requirements change and applicability depends on your specific circumstances - for specific compliance concerns, consult a qualified legal professional.
Call +1 (888) 966-7228.
A human answers 24/7/365.