Treat the alert as urgent
A security product warning, unfamiliar ransom message, or suddenly inaccessible files needs a prompt report. Do not assume every alert means encryption has occurred, but do not dismiss it.
First response
- Stop using the affected device for routine work and contact Softfusion security from another known channel.
- Record the time, exact alert, affected device, and what happened just before it appeared. A photo of the screen may help.
- Follow your incident response team's direction on network isolation. Do not wipe, reboot, or reinstall the machine unless instructed; evidence may be needed.
- Do not pay a ransom or contact an attacker.
Coordinate with support
Tell the team if shared files, email, or other computers appear affected. Security staff can contain the device, investigate scope, and coordinate recovery. CISA's ransomware response guidance outlines additional incident steps.