FAQ
Questions people ask during an incident
Not answered here? Call the incident line and an analyst will pick up.
Ransom and attackers
Should we pay the ransom?
That is your decision, often taken with your board, lawyers and insurer. Paying does not guarantee a working key and can carry legal risk.
We quickly establish what is recoverable without paying, so the decision rests on facts.
Should we contact the attackers?
Not without advice. Anything you say can raise the price or reveal what you know. If contact becomes necessary, we help you plan it.
Confidentiality and evidence
What happens to our data after the case?
We return or securely delete every copy we made, and confirm it in writing.
Will anyone else learn about the incident from you?
No. We do not disclose clients or incidents. Reporting to the authorities is your decision, and we can help you with it.
Working with us
Do you work remotely or on site?
Mostly remotely, through secure access agreed with you. When data cannot leave your premises, we can arrange on-site work.
We have no IT team. Can you still help?
Yes. We explain each step and do the technical work ourselves.
Do you repair damaged hard drives or phones?
No. We recover data with software after cyber incidents, deletions and corruption. A physically damaged device needs a hardware recovery lab.
Time and cost
How long does recovery take?
Containment starts on the first call. Decryption can take hours or days; rebuilding large databases can take longer. You get an estimate once the investigation has scoped the damage.
How is the price calculated?
By scope: the systems involved, the volume of data and the techniques needed. Never by how urgent your situation is.