IT emergency · Hamburg IT emergency? Call me.
Encrypted files, a hacked mailbox, server or internet down: in an IT emergency in Hamburg I also help if you are not a client yet. By phone from 8 am to 6 pm. If I see the phone ringing after that, I pick up.
Typical emergencies and what to do first.
Attack
Files cannot be opened any more, and there is a ransom note on the screen.
Disconnect affected computers from the network right away: pull the cable, switch off Wi-Fi. But do not shut them down. Then call.
Hacked mailbox
Customers are getting strange emails from our account.
Someone else probably has access to the account. I block the unauthorised access, check whether emails are being forwarded secretly and secure the account again.
Outage
Server, network or internet are down, nobody can work.
On the phone we clarify whether I can help remotely or need to come by.
Provider unreachable
Our IT provider cannot be reached.
I start with what I can do without your IT provider and coordinate with them once they are reachable again.
The first few minutes.
Disconnect
Pull the network cable, switch off Wi-Fi. Leave the computer switched on.
Protect backups
Unplug external drives and backup devices so they are not encrypted too.
Delete nothing
Do not reinstall or clean up anything. The traces are needed for the investigation.
Report it
Inform your insurer and the police. If customer data is affected, a report to the data protection authority within 72 hours may be required.
After an attack: recovery layer by layer.
Any system reconnected too early could let the attacker back in. This is the order I used for recovery in one real case, based on that company’s setup.
- Firewallscontrol what goes into and out of the network
- Networkrunning again, still without servers or computers
- Domain controllerssign-in, permissions, name resolution; the basis for every server
- Other serversfile storage and applications from the backup
- Workstationsevery one wiped completely and set up freshTakes the most time
- Printers and other deviceslast, once everything else is back
Recovered from the offline backup.
Every computer and file at a company had been encrypted. I restored everything from a backup the attack had not reached, working from the firewall through to the printers.
- until work resumed
- 48 h until work resumed
- employees affected
- 60 employees affected
- ransom paid
- €0 ransom paid
From the call back to normal operation.
-
01
Call
You describe what happened. I tell you what to do right away.
-
02
Access
By remote support or on site in and around Hamburg.
-
03
Recovery
Contain the damage first, then bring everything back in a fixed order.
-
04
Afterwards
What happened and what should change so it does not happen again.
Briefly answered.
Have a different question? Just write to me.
Yes. On the phone I briefly ask what happened, how I can access your systems and what the work will cost. Then I get started.
I bill by time spent at my regular hourly rate, with no emergency surcharge. I tell you the rate on the phone before I start.
Without a support contract I cannot promise a fixed time. On the phone I tell you honestly whether and when I can help. Fixed response times are part of IT support.
In and around Hamburg, yes. Much is faster by remote support, though, so that is usually where I start.
Is it an IT emergency right now?
Call +49 40 88192642. By phone from 8 am to 6 pm. If I see the phone ringing after that, I pick up.