1. Stabilize
Preserve evidence; do not wipe yet. Isolate affected machines from the network if ransomware is active.
2. Call partners
MSP, insurer hotline, bank if wire fraud.
3. Identity
Reset suspected accounts; revoke sessions; audit MFA methods.
4. Communicate
Internal facts only; no speculation to clients yet.
5. Decide restore vs investigate path
With counsel/insurer as required.
Get Remote Support if you need Qutzl immediately.