24/7 incident line
Have you been compromised?
ACS Cyber helps organizations that have just been hacked contain the threat, find out what happened, work with their insurer and breach counsel on compliance obligations, restore operations and help prevent it from happening again. Whether it is ransomware, phishing, Business Email Compromise or exposed data, call our 24/7 incident line at 1-650-300-7557.
01
Contain
We help you stop the spread without destroying the evidence. Devices, accounts and connections are isolated in an agreed order, approved by someone authorized to make the call.
02
Investigate
Our in-house forensic investigators work to establish how the attackers got in, what they accessed and whether they are still there. Evidence is handled and documented with chain of custody.
03
Coordinate
We work with your insurer, breach counsel and IT provider when you authorize it. You get clear facts to support claims, notification decisions and communications.
04
Recover
We help you restore systems, accounts and data in a controlled order, checked before use. Where rebuilds are needed, the IT operations team at Atlantic Computer Systems can carry them out.
05
Protect
We help close the gaps that allowed the attack and put lasting protection in place. That can include 24/7 monitoring from our in-house SOC, staff training and regular testing.
- Ransomware
- Phishing
- Business Email Compromise
- Wire fraud
- Hacked Microsoft 365 or email account
- Data exposure
- Malware
- Unauthorized access
Not a client yet? You can still call. Not sure whether you have been compromised? Check the warning signs. If the incident is already over and you want to plan next steps, book a free 30-minute consultation instead.
24/7 incident line
In-house forensic investigation
Coordination with insurers and counsel
Recovery and long-term protection
Start here
Not sure what is happening, or what to do first?
If you can see an attack in progress, call the 24/7 incident line now. If you are still working out what you are looking at, these two guides walk you through it.
What to do if you think you have been compromised
Step-by-step first actions, in order: contain, preserve evidence, protect money and accounts, and bring in your insurer and counsel.
How to tell if you have been compromised
Warning signs by area, what each one may mean, and a self-check you can run today.
Incident types
What happened?
ACS Cyber is the managed security services provider (MSSP) and cybersecurity division of Atlantic Computer Systems, with an in-house 24/7 SOC. We help organizations nationwide respond to the incidents below. Choose the one closest to yours for first steps and what to expect.
Ransomware
Files are encrypted, systems will not open or a ransom note has appeared. Isolate affected devices, keep the evidence and call before you restore anything.
Business Email Compromise and wire fraud
A fraudulent invoice was paid, bank details were changed or a trusted mailbox sent payment requests. Call your bank first, then call us.
Phishing and hacked accounts
Someone clicked a link, entered a password or approved an MFA prompt, and a Microsoft 365 or email account is now behaving oddly.
Data breach or exposure
Customer, patient, employee or financial records may have been accessed, copied or shared. An investigation tells you what, whose and how.
Malware
Security alerts, unfamiliar programs or systems acting strangely. We identify what is running, how it arrived and what it touched.
Unauthorized access
Unknown accounts, remote access nobody set up or changes nobody made. We find out how access was gained and help remove it.
Please do not send passwords, private keys, protected health information, financial records, logs or evidence files to anyone by email or chat, including us. Once we are engaged, we arrange secure evidence handling.
After the first response
Already contained? What comes next
Once the immediate threat is under control, most organizations need two things: the facts about what happened, and a clean path back to normal operations with stronger protection.
Incident investigation and forensics
Find out how the attackers got in, what they accessed or took and whether they are still present, with evidence handled under documented chain of custody and findings your counsel and insurer can use.
Recovery and protection after an attack
Recover from clean sources, close the root cause and add 24/7 monitoring, training and testing so a repeat is less likely.
In-house forensic investigation
Find out what happened
Containment stops the damage. Investigation tells you what the damage was. Our forensic investigation is performed in-house, by the same organization that runs our 24/7 SOC, so findings feed straight into containment and recovery decisions.
Depending on what the incident touched, we examine endpoints, servers, email, Microsoft 365 or Google Workspace, cloud accounts, firewalls and backups. Evidence is collected and handled with documented chain of custody, so it can support insurance claims, legal review and, if you choose to report, law enforcement. See what an incident investigation covers.
What our investigation works to answer:
- How the attackers got in
- What they accessed, changed or took
- Whether they still have access
- What data was exposed, and whose
- A timeline of what happened and when
- The root cause, and what to fix first
What you receive
- Plain-language findings for leadership
- Technical detail for your IT team or provider
- A documented timeline and evidence record
- Affected-data analysis for your counsel
- Prioritized remediation recommendations
Coordination
Your insurer, your counsel and your compliance obligations
If you have cyber insurance, notify your carrier early and check your policy. Many policies set notice requirements, and some require approved vendors or the carrier’s consent before costs are incurred.
We work alongside insurer-assigned response firms where your policy permits, and we coordinate with your legal counsel and insurer when you authorize it. Our documentation can support your claim with a clear record of what happened and what was done.
Notification decisions are yours to make with your counsel. We give counsel the facts they need to advise on obligations under HIPAA, state breach-notification laws, PCI DSS and your contracts. We do not provide legal advice.
- Early guidance on insurer notice and documentation
- Facts and timelines for breach counsel
- Affected-data analysis to inform notification decisions
- Coordination with your IT provider, bank and other authorized parties
Who is usually involved
- Your leadership, and whoever can approve actions
- Your cyber-insurance carrier or broker
- Your legal counsel or breach counsel
- Your internal IT team or IT provider
- Your bank, if payments are involved
- Law enforcement or government reporting channels, such as the FBI’s IC3 or CISA, if you choose to report
Our process
From the first call to lasting protection
Every incident is different, and steps often overlap. You get regular updates in plain language throughout. Learn more about our incident response and DFIR services.
01
Triage
We confirm what is happening and agree on the first actions with someone authorized to approve them.
02
Contain
We help isolate affected devices, accounts and connections to stop the spread while preserving evidence.
03
Investigate
Our in-house forensic team works to establish how the attackers got in, what they did and what they accessed.
04
Coordinate
We share findings with your insurer, counsel and IT provider, as you direct, so everyone works from the same facts.
05
Eradicate
We remove the attackers’ footholds and close their way in before systems come back, reducing the risk of reinfection.
06
Recover
We help restore systems and data in a controlled order, from clean backups or clean rebuilds, checked before use.
07
Protect
We help you fix remaining weaknesses and add ongoing protection, from 24/7 monitoring to training and testing.
After the incident
So it does not happen again
Recovery is the start, not the finish. The team that helped you respond can help you build lasting protection, at a pace that fits your budget. See how we help you recover and harden after an attack.
Managed detection and response
Our in-house SOC analysts monitor your endpoints, identity, email, cloud and network 24/7, and take pre-approved containment actions under rules agreed with you in advance.
Security awareness training
Phishing simulations and practical training help your people recognize phishing, payment fraud and impersonation, and report it.
Vulnerability management and penetration testing
Regular scanning, prioritized remediation and in-house penetration testing help find the gaps attackers look for.
vCISO and incident-response planning
A security roadmap, a written incident-response plan and tabletop exercises, so key decisions are made before the next incident.
Microsoft 365 hardening
MFA, conditional access, mailbox protections and admin controls that close common routes into email accounts.
Compliance and insurance readiness
Gap assessments and remediation aligned with HIPAA, PCI DSS, NIST CSF 2.0, CIS Controls and the controls insurers ask about.
For everyone
Not a client? Call anyway
You do not need a contract with us to call. Our 24/7 incident line helps organizations that are not yet clients, as well as existing ones. We discuss scope and costs with an authorized decision maker before work begins.
Already working with an IT provider? We work alongside them, with clear roles so work is not duplicated or undone.
When systems need a clean rebuild, Atlantic Computer Systems, our parent company, provides managed IT, including helpdesk, Microsoft 365 administration, cloud, networks, VoIP and IT logistics. Security fixes are carried through in the underlying IT, not left as a list of recommendations. Learn about Atlantic Computer Systems.
We support organizations nationwide from our headquarters in San Jose, California, and our office hub in Boston.
When you call, have this ready
- Your name, organization and a callback number
- What you are seeing, and when it started
- Who and what is affected
- Your insurer and policy details, if you have them
- Who can approve response actions
FAQ
Questions people ask after a cyberattack
Isolate affected devices from the network without powering them off or wiping them, and call an incident response team before you restore or rebuild anything. Keep suspicious emails, files and logs in place, notify your cyber insurer and bring in legal counsel early. If money may have gone to a fraudster, call your bank’s fraud line first.
ACS Cyber’s 24/7 incident line is 1-650-300-7557. You can also report the incident to the FBI Internet Crime Complaint Center (IC3) or CISA.
ACS Cyber helps organizations after a ransomware attack. We help contain the spread, investigate in-house how the attackers got in and what they took, coordinate with your insurer and counsel, and plan a controlled recovery. See our ransomware response page for first steps.
A forensic investigation answers that question. Our in-house investigators examine sign-in records, audit logs, endpoint activity, file access and network records to establish what was accessed, when, and through which account or device.
The result is a documented timeline and an affected-data analysis for your leadership, insurer and counsel.
Yes. We coordinate with your insurer when you authorize it, and we work alongside insurer-assigned response firms where your policy permits. Contact your carrier early, because many policies set notice requirements and some require approved vendors.
It depends on the facts and the law, and it is a decision to make with your legal counsel. Obligations can arise under state breach-notification laws, HIPAA, the FTC Safeguards Rule, PCI DSS and your contracts, depending on what data was involved and whose it was.
Our part is the evidence: what data was accessed, whose it was, how and when. See data breach response for more.
Yes. We work alongside internal IT teams and outside IT providers. They know your environment, and we bring forensic investigation and incident response experience. We agree on roles early so work is not duplicated or undone. For organizations reviewing how their IT support is set up, Atlantic Computer Systems, our parent company, publishes guides to managed IT costs and support models.
Fix the root cause first, then add protections that help detect and stop the next attack earlier. For most organizations that means stronger sign-in security, monitored endpoints and accounts, tested backups and trained staff.
ACS Cyber offers 24/7 managed detection and response from our in-house SOC, security awareness training, vulnerability management with in-house penetration testing, and vCISO planning. Atlantic Computer Systems, our parent company, also publishes practical cybersecurity guides for businesses.
No. Organizations that are not yet clients can call our 24/7 incident line at 1-650-300-7557. We help with first steps on the call and discuss scope with an authorized decision maker before any engagement begins.
ACS Cyber provides incident response and in-house forensic investigation for small and midsize organizations nationwide. We are headquartered in San Jose, California, with an office hub in Boston, and our 24/7 incident line is 1-650-300-7557.
24/7 incident line
Talk to our incident team now
If you think you have been compromised, call 1-650-300-7557. If the incident is over and you want to plan what comes next, book a free 30-minute consultation.