Incident response · Active breach

Under attack? Breathe. Then do this.

If you think you've been breached, the next 60 minutes matter. Work through the steps below, then call us — we'll take it from there.

// First response — do these now

The basics, in order.

01
Isolate, don't power off Disconnect affected machines from the network — pull the cable or Wi-Fi. Do not shut them down: powering off can destroy evidence sitting in memory that we need to understand the attack.
02
Stop the spread If it's safe to do so, segment the network and disable the compromised accounts. Suspend remote access (VPN, RDP) so the attacker can't simply log back in.
03
Preserve the evidence Leave logs, emails and systems as they are. Don't delete suspicious files or wipe machines — take photos of ransom notes or error screens instead.
04
Reset credentials from a clean device Change passwords for critical and admin accounts, and enable multi-factor authentication — but do it from a device you know is not compromised.
05
Write down the timeline Note what you saw and when: the first warning, odd emails, locked files, unexpected logins. This short log saves hours in the investigation.
06
Call Sploitless Phone the hotline and say "incident" — active breaches jump the queue. We'll guide containment live and start the investigation immediately.
07
Then notify who you must Depending on the breach you may have legal duties (e.g. GDPR notification within 72 hours). We'll help you work out who to tell and when — don't rush this before you understand the scope.
// Do NOT
✕Don't pay a ransom before speaking to us — it rarely ends the problem.
✕Don't reboot or re-image machines; you'll destroy evidence.
✕Don't "clean up" by deleting files or emails.
✕Don't tip off the attacker by discussing it on the compromised systems.
// Reach the team

Say "incident" and you jump the queue.