Something is encrypted, or an account is compromised.
Containment first, then a restore path with a stated RTO. We work the incident and hand you the written timeline afterwards.
You are here if
- Files renamed, or a ransom note on a share
- Staff locked out, or mail rules nobody created
- Invoices going to an account that is not yours