Do this first — before you "fix" anything
The instinct to reset, reinstall, or wipe a compromised device often destroys the very evidence you will later need. Preserve first.
- Do not power-cycle or factory-reset the affected device.
- Disconnect from the network if you can do so safely (unplug Ethernet / disable Wi-Fi).
- Do not pay a ransom or extortion demand before speaking with us.
- Write down what you saw and when — times, messages, and any changes.
- Call us at (310) 270-0598.