Stay calm, don't wipe the computer, and call us first: (206) 593-8072. The next few minutes matter, and the wrong move can make recovery harder.
| Your plan | What applies to you |
|---|---|
| Managed plan | Follow the steps below, then call us. We investigate and lead the recovery with you. |
| Ordered online (self-serve) | Follow the steps below, then call us. If you have managed detection and response from us, its security team may already be on it. |
You'll know it worked when the computer shows no network connection and you've reached us or left a message.
Why disconnect but leave it on? Ransomware can spread to other computers on the same network. A running computer still holds evidence in its memory that shows what happened. A restart or shutdown erases that, so shut down only if you can't disconnect it.
Stop and call us if you see any of these:
| What you see | What it may be |
|---|---|
Files renamed with strange endings, such as .locked or random letters |
Ransomware |
| A text file or pop-up demanding payment | Ransomware |
| A browser pop-up saying your PC is infected and to call a number | A scam. Don't call the number |
| The computer is suddenly much slower and the fans run all the time | Hidden software using the computer, or an active attack |
| The mouse moves by itself, or things open on their own | Someone controlling the computer remotely |
| You're locked out of an account you didn't change | A stolen password |
| Colleagues get strange emails from you | Your email account has been taken over |
| Your antivirus is suddenly turned off | Someone has tampered with your protection |
A false alarm is far better than sitting on a real incident.
You can also report the attack to the FBI's Internet Crime Complaint Center.
Once things are stable, we go through it with you: what happened, how the attacker got in, and what we changed to stop it happening again.
Many attacks start with someone clicking a link in a convincing email. Helping staff spot phishing is the most useful thing you can do. Ask us about security awareness training, or see security services.
| Phone, urgent | (206) 593-8072 |
| [email protected] | |
| Client Portal | portal.rainier-it.com |
Save (206) 593-8072 in your phone now, so you don't have to search for it in an emergency.
Last reviewed: October 2026