Ransomware
You can't open files, file names have changed, or a message is demanding payment.
Urgent help: security
Under attack? Get help now.
Ransomware on the screen, a Microsoft 365 or Google account someone else is using, or activity you can't explain. Call 1300 274 655 and speak to an engineer. The first conversation is about stopping it spreading and deciding what to do next.
Call now
What to expect
Call now. If we can't answer straight away, an engineer calls back as soon as one is free. Emergency work is charged at our incident rate, confirmed with you before we start.
Can't get through? Tell us what is happening.
Signs this is the page you need.
You don't have to be certain. If any of these sound familiar, call.
A hijacked account
Email you didn't send, sign-ins from places nobody has been, mail forwarding rules you didn't create, or a password that has stopped working.
Activity you can't explain
Accounts or devices nobody recognises, security alerts you can't read, or someone outside telling you your business is sending them strange messages.
A suspected breach
You think business or customer information has left the building, or someone has told you it has.
What to do while you call.
These are the usual starting points. The engineer will confirm which ones apply to your situation.
Disconnect, don't wipe
Take affected devices off the network and Wi-Fi. Don't reinstall, wipe or delete anything yet.
Don't pay or reply yet
Hold off on paying a ransom or answering a demand until you have spoken to someone.
Secure the account from a clean device
If someone else is using an account, change its password from a device you trust and sign out its other sessions.
Write it down
Note what you saw and when. A phone photo of the screen is enough.
What happens when you call.
A short, direct conversation led by an engineer, not a menu and not a sales pitch.
You say what you can see
What is affected, when it started and what it is stopping you doing.
We work out what to stop first
Containing the problem comes before finding its cause.
You decide the next step
We explain the options and what each involves, and agree the work with you before it starts.
Why call Kritical.
Security problems rarely stay in one place. They run through accounts, devices, networks, backups and the people who use them.
Engineers across the whole environment
Our team works on identity, devices, networks, Microsoft 365, backup and data centres, so the conversation doesn't stop at the edge of one product.
Systems we work with
Kritical is a Microsoft partner and a CrowdStrike reseller. If your accounts or devices sit in Microsoft 365, Google Workspace or CrowdStrike Falcon, the screens in front of you are ones we know.
Already on CrowdStrike Falcon Complete?
CrowdStrike runs the response under your contracted service. Call us as well and we will work with you around it.
When it is under control.
Once the immediate problem is handled, we can look at what happened and what would make it less likely to happen again. That is a separate conversation and it is your call.
Essential Eight baseline
See where your controls stand and what to fix first.
Tested backup
Make sure data can be restored when it matters.
Endpoint protection someone is watching
Compare coverage options for your devices.
Email and phishing protection
Stop the next fake invoice or sign-in page before it lands.
Questions before you enquire
Do I have to be a customer to call?
No. Call 1300 274 655 whether or not you have worked with us before. If you already have a Kritical support agreement, its contact and escalation route is also open to you.
Should I switch the affected computers off?
Disconnect them from the network first and don't wipe or reinstall them. The engineer will tell you whether to leave them running or power them down.
Do I need to report this to anyone?
It depends on what is affected. Your lawyer or privacy adviser decides what the law requires of you, and we can supply the technical facts they need. The Australian Cyber Security Centre takes reports through ReportCyber at cyber.gov.au.
What will it cost?
Emergency work is charged at our incident rate, and we confirm it with you before we start.
Should I send passwords or sensitive files through the form?
No. Describe what you can see and leave the rest for the call. We will agree a safe way to share anything else that is needed.