Ransomware
Files encrypted. Logins locked. Call before you reboot the building.
Ransomware is an emergency incident, not a monthly package. Avery Parker contains it, gets operations back, then closes the hole. Pricing is quoted after discovery — not published as a rate card.
First hour
- Call. Do not wait to finish a written timeline.
- Do not pay from a personal card while you are still in shock.
- Do not restore last night’s backup until someone checks whether the backup is also dirty.
- Do not wipe every machine to “start clean.” You will destroy evidence and often the only copy of the files.
- If counsel or a carrier is in the picture, they can join the first call. We treat it as confidential.
The commercial engagement — contain, restore operations, harden — lives on the incident response page. A written discovery intake is what we walk through on that call.
If only the public website is spam and the rest of the business is fine, that is hacked WordPress, not this page.
Questions we get
Should we pay the ransom?
Do not pay from this page and do not decide that in a panic. Call. If you have a cyber policy, call that number as well. Paying is a business and legal decision, not a technical one we make for you.
Should we power everything off?
Do not reboot every machine “to see if it comes back.” Isolate what is still talking to the attacker. We will say what to unplug on the first call.
Is this the same as hacked WordPress?
No. A compromised public website with the rest of the business fine is the WordPress IR job. This page is for when files are encrypted, logins are locked, or you cannot trust the servers.
Do not wait for a perfect inventory.
Tri-Cities 423-888-0252 · Western NC 828-484-1257