When a cyber incident is unfolding, the first actions matters. Take the immediate actions (as germane to your situation) then call Joanna Wiggum directly at (509) 393-0896.
Ransomware or suspected malware
First action: Isolate the affected machine from the network. Do not power it off.
Disconnect Wi-Fi, unplug the network cable, and stop the device from communicating with other systems. Do not restart, shut down, or attempt cleanup before evidence is preserved.
Wire fraud, business email compromise, or payment diversion
First action: Contact the bank immediately.
Ask for the fraud department and request a wire recall or fraud recall. The recovery window can close quickly, and technical support cannot recover funds once the money moves beyond reach.
Account compromise
First action: Revoke active sessions.
A password reset alone may not remove an attacker who already has an active session. Sign out all devices, revoke sessions, remove unknown recovery methods, check forwarding rules, and enable multi-factor authentication where available.
Identity theft, retirement-account fraud, or unauthorized transfers
First action: Contact the financial institution’s fraud department and preserve records.
Request written confirmation of the fraud report and preserve transaction details, emails, texts, portal messages, account notices, screenshots, call logs, and any names or reference numbers provided.
Impersonation, harassment, stalking, or doxing
First action: Preserve evidence before engaging.
Capture screenshots, URLs, usernames, timestamps, phone numbers, email headers when available, and the full content of messages or posts. If there is immediate physical danger, call 911 first.
Suspicious message, link, invoice, or request
First action: Stop and verify through a separate trusted channel.
Do not click the link, open the attachment, approve payment, change account access, or reply in the same thread until the request is verified through a known phone number, known email address, or established contact method.
Countervail LLC
Washington State Licensed Private Investigation Agency
PI License #26010541
Veteran-owned | Serving clients nationwide