Stop the interaction
Cut off the exchange in progress, hang up, close the remote access session, stop sending anything. As long as the channel stays open, the situation keeps moving against you.
The firm · Incident emergency
You are dealing with an incident right now.
Ransomware, intrusion, data leak, hacked account, fraud: the decisions of the next few minutes weigh on everything that follows. This page is about one thing only: the steps that destroy nothing, then the right way in to get help.
First conversation confidential, no commitment. We never ask for your codes.
Three things not to do, right now.
Don’t delete anything, don’t pay anything, and don’t give in to haste. Containing the spread is legitimate, but doing it without method often destroys what the analysis, the insurer, the bank or the courts will need. Badly preserved evidence is worthless.
01 · IMMEDIATE STEPS
Stabilise without destroying.
The natural reflexes after an incident, reinstalling, deleting, “starting again from scratch”, are the ones that cost the most later. Here is the order that protects what comes next.
Delete nothing
Messages, emails, logs, screenshots, statements: everything that documents the incident has value. Don’t reinstall, don’t format, don’t “clean up” before the evidence has been set aside.
Secure access
From a clean device, take back control of the accounts that control the others, starting with your email. No one serious will ever ask you for your codes.
02 · THE RIGHT WAY IN
Depending on your situation, help does not start in the same place.
No need to wait for a call back to get started. Three ways in, choose just one.
03 · THE FIRST HOURS
The sequence the firm keeps to, by your side.
From alert to recovery, six stages, in this order. Each decision protects the next.
1AssessFrame the situation before taking any action, to avoid steps that make things worse.
2StabiliseContain the spread and preserve the evidence, at the same time.
3Open the crisis unitA single point of decision: who decides, who speaks, who acts.
4LogEvery finding, every decision and every action, timestamped in a crisis log.
5CommunicateControlled messages, internally and externally, at the right time.
6Prepare the recoveryRemediation priorities and an exit plan, once the emergency is under control.
The first hours of a cyber crisis, in detail → · Digital evidence: delete nothing →
04 · THE PUBLIC SCHEME
You can also go through the State, and it is free.
Datashield Risk Consulting is a provider listed on Cybermalveillance.gouv.fr, the French national victim assistance scheme run by the public interest group GIP ACYMA. It is a listing, not a state certification. The 17Cyber platform directs victims to an initial diagnosis and to the next steps, including filing a complaint with the police.
05 · REACH US
Describe the situation, we call you back.
The form remains the fastest route: it gives us what we need to assess the situation from the outset. You can also write to or call the firm.
FormA call back from a person, immediate decisions→
contact@galyct.ioWrite to the firm→
09 73 37 47 16The firm’s switchboard, Lyon→
What we do not promise: a guaranteed response time outside a contract. Costed on-call arrangements, with an SLA of 4 business hours or 2 h on a 24/7 basis, fall under the crisis retainer. No result is guaranteed: no refund, no recovery of funds, no identification of the perpetrator. Commitments, not promises.