Emergency IT support for cyber attacks and system failures

Hacked, locked out or facing a major system failure? Call 020 7613 1378 now. Our team helps London and UK businesses contain the problem, restore critical systems and get back to work.

Available 08:00 to 18:00, Monday to Friday. Out-of-hours emergencies: we respond as soon as possible, usually within 1 hour. On-site help available in London when needed.

What to do right now

1. Call us before making major changes. Well-meant fixes can spread the damage or destroy evidence.
2. Disconnect affected devices from the network and Wi-Fi. Unless we advise otherwise, leave them switched on.
3. Do not delete files, wipe devices or restore backups yet. Backups may also be affected.
4. If you think email is compromised, use a phone or a separate clean device to communicate.
5. Do not reply to attackers or pay a ransom before getting advice.
6. Write down what you noticed, when it happened and who has been told.
7. Contact your cyber insurer early if you have one. Your policy may set out what you need to do.

Cyber attacks and infiltrations we respond to

• Ransomware and encrypted files
• Hacked Microsoft 365 and business email accounts
• Unauthorised access to servers, networks or cloud systems
• Invoice and payment fraud following a mailbox compromise
• Malware and suspicious remote access software
• Suspected data theft or data breaches
• Compromised websites

Signs someone may be inside your systems

• Files will not open or have unfamiliar extensions
• New administrator accounts or unexpected password resets
• Email rules or forwarding that nobody set up
• Security tools switched off without explanation
• Logins from unusual places or at unusual times
• Clients receiving strange emails from your address

Catastrophic system failures we respond to

• Server failure or a server that will not start
• Failed storage or RAID arrays
• Lost, corrupted or accidentally deleted data
• Microsoft 365 lockouts or major configuration problems
• Failed backups or a recovery that does not work
• Network, firewall or internet failure
• Phone system outages
• Fire, flood or power damage affecting IT equipment

How we respond

1. Triage. We establish what happened, what is affected and what is most urgent.
2. Contain. We isolate affected systems and stop the problem spreading.
3. Investigate. We preserve useful evidence and work out how far it went.
4. Recover. We restore priority systems from clean sources, in the right order.
5. Coordinate. We work with your insurer, suppliers and advisers as needed.
6. Prevent. We close the route used and give you a clear plan to reduce the risk of it happening again.

Who may need to be told

If personal data is involved, a reportable breach must normally be reported to the ICO within 72 hours of becoming aware of it. In England, Wales and Northern Ireland, cyber crime can be reported to Report Fraud at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. You may also need to tell your insurer, clients, regulator or bank. We can provide the technical facts you need, but take legal advice on your obligations.

Should you pay a ransom?

Get advice before making any decision, and check guidance from the National Cyber Security Centre (NCSC). Paying does not guarantee your data will be returned or deleted, and it may create legal and sanctions issues. Our first goal is to find out what can be recovered safely without paying.

What emergency IT support costs

£375 + VAT upfront, so we can start straight away. This covers your first 3 hours of emergency work.

• Finished sooner? We refund the unused time.
• Need longer? Further work is £125 per hour + VAT, and we will tell you before it goes over.

Once you are back up and running

Cloud backup | Disaster recovery | Email and network security | Cyber Essentials | Managed IT support

Related reading: What happens when you are hit with ransomware?

Case study: Recovering from ransomware with no backups in place

Frequently asked questions