Active incident
Under attack right now? Do these four things, then talk to a responder.
This page is for live incidents only — a breach in progress, money moving, ransomware notes, an account you no longer control. You do not need to be a customer.
If this is a business
Step 1
Don't power anything off
Pulling power destroys volatile evidence. Isolate from the network instead.
Step 2
Freeze outbound money
Call your bank's fraud line and place a hold on pending wires and ACH batches.
Step 3
Rotate the obvious
Reset admin credentials and revoke active sessions and OAuth grants for privileged accounts.
Step 4
Preserve everything
Stop log rotation, snapshot affected hosts, and start a written timeline with timestamps.
If this is your family
Step 1
Stop paying
If money is being requested right now, stop. No legitimate institution needs gift cards or crypto.
Step 2
Call the bank directly
Use the number on the back of the card, never a number from the message you received.
Step 3
Freeze your credit
Free at all three bureaus. It takes about ten minutes and blocks new-account fraud.
Step 4
Don't delete anything
Keep the texts, emails, and call logs — they're the evidence.