24/7 incident line
Dealing with an active incident?
Call our 24/7 incident line.
If you suspect ransomware, a hacked email account, fraudulent payments or unauthorized access, call 1-650-300-7557 now. Our in-house incident response team helps you contain the threat, preserve evidence, find out what happened and decide what to do next.
24/7 incident line1-650-300-7557Answered 24/7. Not a client? Call anyway. Tell us your name, organization, a callback number and what you are seeing.
Incident line answered 24/7
Not a client? Call anyway.
In-house forensic investigation
Evidence handled with documented chain of custody
Works alongside insurer-assigned firms where your policy permits
First steps
What to do right now
These steps apply to most incidents. If our team, your insurer or your counsel advises differently on the call, follow their direction. For the full checklist, see what to do if you think you have been compromised.
01
Call us
Call our 24/7 incident line at 1-650-300-7557. Early guidance helps you avoid steps that make the incident harder to investigate or recover from.
02
Notify your insurer early, and your counsel
If you have cyber insurance, check the policy’s notice requirements and call the carrier’s claims line. Bring in legal counsel early to advise on your obligations.
03
Isolate, do not wipe
Disconnect affected devices from the network by unplugging the cable or turning off Wi-Fi. Avoid powering them off, wiping or reimaging them, which can destroy information needed to understand what happened.
04
Keep the evidence
Do not delete suspicious emails, files, inbox rules or logs, even if they look harmful. Leave them in place until they have been documented and examined.
05
Do not engage the attacker
Do not reply to, contact or pay the attacker. Decisions about any communication belong with your leadership, counsel and insurer, guided by the response team.
06
Call your bank about suspicious payments
If money may have gone to a fraudulent account, call your bank’s fraud line immediately and ask them to try to stop or recall the transfer. Then report it to the FBI’s Internet Crime Complaint Center at ic3.gov.
07
Communicate out of band
If email accounts may be compromised, coordinate by phone or from a separate, known-clean device. Assume the attacker can read messages sent from affected accounts.
08
Write down what you noticed
Note what you saw, when, who noticed and what has been done so far. A simple timeline saves time later.
Do not send passwords, private keys, protected health information, financial records, logs or evidence files to anyone by email or chat, including us. Once we are engaged, evidence is collected and handled through our documented process, with chain of custody.
Incident guides
What kind of incident are you facing?
Each page explains what to do now, what we do and how we help you prevent a repeat. We also respond to malware, unauthorized access, insider activity and cloud incidents.
Ransomware
Encrypted files, ransom notes or systems that suddenly will not open.
Business Email Compromise and wire fraud
Fraudulent payment requests, changed bank details or messages sent from a trusted account.
Phishing and hacked email or Microsoft 365 accounts
Unfamiliar sign-ins, new inbox rules or MFA prompts nobody requested.
Data breach and exposure
Records or files that may have been accessed, shared or taken.
Step-by-step first actions
What to do, in order, from containment to calling your insurer.
Not sure it is an incident?
Warning signs by area, and a self-check you can run today.
Before you call
Have this ready when you call
You do not need every answer. Share what you know, and we will help with the rest.
- Your name, organization and a callback number
- Who and what is affected: users, devices, mailboxes or locations
- When the activity started, or when it was first noticed
- Systems involved, such as Microsoft 365, servers, cloud applications or backups
- Any ransom note or unusual messages, described in your own words
- Whether any payments were made or bank details changed
- Your cyber-insurance carrier and policy details, if available
- Who can authorize response actions, such as isolating systems or resetting accounts
Our process
What happens after you call
Every incident is different, but our response follows a consistent method, with in-house forensic investigation running alongside containment. Learn more about our incident response and DFIR services.
01
Triage
We confirm what is happening, what is at stake and what to do first.
02
Scope
We identify the affected users, systems and data, and how far the activity reaches.
03
Contain
We work with your team to stop the spread while preserving evidence.
04
Investigate
Our forensic investigators build a timeline of how the attacker got in and what they did, with documented chain of custody.
05
Eradicate
We remove malicious access, persistence and the weaknesses that allowed it.
06
Recover
We help restore systems and accounts in a controlled order, checked before use.
07
Strengthen
We recommend and help implement changes that reduce the chance of a repeat.
Coordination
Working with your insurer and counsel
Many incidents involve more than technical work. If you have cyber insurance, contact your carrier early and follow its notice requirements. If your insurer assigns a response firm, we work alongside that firm where your policy permits.
Legal counsel advises on notification obligations, contracts and communications. When you authorize it, we coordinate with your counsel and insurer and give them clear technical findings to support their decisions. We do not provide legal advice.
- Technical findings explained in plain language
- A documented timeline of what happened and what was done
- Documented evidence handling with chain of custody
- Coordination with your internal IT team or IT provider
Who is usually involved
- Your leadership and the person who can approve actions
- Your internal IT team or IT provider
- Your legal counsel
- Your cyber-insurance carrier
- Your bank, for suspected payment fraud
- Our incident response team
After the emergency: how we help you recover and prevent a repeat
Once the threat is contained, we help you restore operations in a controlled order and close the gaps that let the attacker in. Then we help protect you going forward with 24/7 monitoring from our in-house SOC, security awareness training, vulnerability management and security planning.
FAQ
Active incident questions
Call for help, isolate affected devices from the network without wiping them, keep the evidence, and call your bank right away if money may have moved. Then notify your cyber insurer and legal counsel. The first steps above walk through each one.
Yes. Any organization dealing with an active incident can call our 24/7 incident line at 1-650-300-7557, client or not. ACS Cyber is headquartered in San Jose, California, with an office hub in Boston, and provides nationwide support. For day-to-day IT, Atlantic Computer Systems, our parent company, lists its IT support locations.
Yes, where your policy permits. We work alongside insurer-assigned response firms, and when you authorize it, we coordinate with your insurer and legal counsel. Check your policy’s notice requirements and call the carrier’s claims line early.
Our forensic investigation is performed in-house, with documented evidence handling and chain of custody. On the call, we guide you on what to keep. Please do not send evidence files by email or chat.
Every incident is different. We discuss scope, approach and costs with an authorized decision maker before work begins. If you have cyber insurance, ask your carrier how response costs are handled under your policy.
Notification obligations, such as those under state breach-notification laws, the HIPAA Breach Notification Rule or your contracts, are legal questions for your counsel. We support counsel with technical findings about what was accessed and when, so they can advise you.
Usually not before the threat is contained and understood. Restoring too early can reintroduce the attacker or overwrite evidence. We help you decide what to restore, and when. For the restore itself, we work with your IT team or with the engineers of Atlantic Computer Systems, our parent company, which provides managed cloud and backup services.
24/7 incident line
Talk to our incident team now
If you are dealing with an active incident, call 1-650-300-7557. If the incident is over, or you want to prepare for the next one, book a free 30-minute consultation about a post-incident review, response planning or readiness.