Under attack right now? Call 207-941-0264.
Ransom note, locked files, or strange logins? Call us now from a phone you trust, not a device that may be affected. Our emergency line is always staffed, day or night. You can expect a statement of work and agreement within the same hour, so recovery work can start right away.
In the first hour:
- Disconnect affected computers from the network. Unplug the network cable and turn off Wi-Fi.
- Leave them powered on. Don’t shut them down, wipe them, or reinstall anything yet.
- Don’t pay, and don’t contact the attackers. Leave any decision about the ransom to your leadership, legal counsel, and insurer.
- Call your cyber insurance carrier. Many policies have a claims hotline and want to hear from you early.
- Keep what you can. Photograph ransom notes and write down what you saw and when.
A ransomware attack stops a business cold. Files won’t open, systems are down, and everyone is looking at you for answers. S. J. Rollins Technologies provides incident response and ransomware recovery that gets you back in control, restores what can be recovered, and secures your environment.
We’ve served organizations across Maine, New Hampshire, and Massachusetts since 1986, and we provide incident response and ransomware recovery for businesses anywhere in the United States. Our mission is to remove the burdens of technology by providing solutions that create efficiency, stability, and security. In an incident, that means carrying the technical weight so you can lead your business through it.
What incident response with S. J. Rollins covers
Every incident is different, but recovery follows five clear steps:
- Plan the recovery with you. We confirm what matters most to your business, set the order of work, and keep you updated on a regular schedule.
- Contain the threat. We help isolate affected systems, lock down accounts and passwords, and reduce the chance of the attack spreading again while we recover.
- Restore systems and data. We restore what’s recoverable from your backups and other sources you control, rebuild what isn’t, and test that restored systems work.
- Strengthen your defenses. We make targeted security improvements, such as multi-factor authentication, endpoint protection, reliable backups, critical patches, and better logging.
- Hand over a clear record. You get a summary of what we did, where your environment stands, and what we recommend next.
What to expect
We start with what keeps your business running. Systems come back in order of business impact, so what you need most comes first.
You’ll get straight answers. We’ll tell you what looks recoverable and what doesn’t as soon as we know. Timing depends on how far the attack spread and the condition of your backups, so we give honest estimates and update them as we learn more.
We stay with it. Recovery is hands-on work. Wherever you are in the United States, we can send our team on site for hands-on recovery, working alongside our remote engineers.
We work alongside your legal, insurance, and forensic team
A serious incident usually brings in several partners. Our job is getting your technology back and keeping it secure, and we coordinate closely with:
- Your cyber insurance carrier and any response team your policy assigns.
- Your legal counsel, who guides breach notification, regulatory and law enforcement reporting, and any decisions about the attackers.
After recovery: staying protected
Getting back up is the first goal. Staying up is the next. Once the emergency is over, we help close the gaps that let the attack in:
- Endpoint security on every computer and server
- Firewall management with ongoing monitoring and updates
- Hosted backups and disaster recovery, including off-site copies with Veeam Cloud Connect
- A security assessment to find what else needs attention
From there, ongoing managed IT services and our broader security services keep patching, monitoring, and backups handled every day, not only after a crisis.
Learn more about who we are, or contact us to talk through your situation.
Incident response FAQs
What should I do first if we get ransomware?
Disconnect affected computers from the network, but leave them powered on. Don’t wipe or reinstall anything, and don’t contact the attackers. Call your cyber insurance carrier, take photos of any ransom notes, and call S. J. Rollins at 207-941-0264 from a phone you trust. Calm steps in the first hour protect your options.
Should we pay the ransom?
That decision belongs to your leadership, legal counsel, and insurer, and we don’t negotiate with or pay attackers. We prioritize recovering from backups and sources you control, so your options don’t depend on criminals keeping their word.
How long does ransomware recovery take?
It depends on how far the attack spread, the condition of your backups, and how quickly outside vendors respond. We restore the most important systems first so you can get back to work sooner, and we give you honest estimates that we update as the picture becomes clearer.
Can you recover our data?
It depends on what survived the attack, and we work hard to find every recoverable copy. We restore from your backups and other copies you control, then rebuild what can’t be restored. We’ll tell you early and honestly what looks recoverable. Tested backups kept off your main network make the biggest difference.
Do you work with our cyber insurance company?
Yes. We work alongside your insurer and your legal counsel. Call your carrier early, since many policies have a claims hotline and preferred vendors. We focus on containing the threat and restoring your systems, while they handle claims, legal advice, notification, and formal investigation.
Do you only help existing clients?
No. We help businesses that aren’t current clients recover from ransomware and other cyber incidents. Our emergency line at 207-941-0264 is always staffed, and you can expect a statement of work and agreement within the same hour so recovery can begin. We manage recoveries anywhere in the United States, remotely and on site.
