Emergency cyber incident response

Been hacked? Let’s get you back in control.

Locked out, a ransom note, money redirected, or activity you can’t explain? Stay calm. Foresight’s incident response team helps businesses across the UK contain the damage, recover safely and stop it happening again — remotely within the hour, and on-site across Greater Manchester.

Call 0161 738 1399 nowUrgent callback

Remote response UK-wide, usually within the hour · On-site across Greater Manchester · Cyber Essentials Plus · CREST-approved

Stay calm — don’t

  • Pay any ransom before speaking to us
  • Delete or wipe anything yet
  • Keep logging in and out
  • Wait — the first hour matters most

Need help now? Request an urgent callback

Leave your details and we’ll call you straight back. Or call 0161 738 1399 right now.

Is this you?

Signs you’ve been hacked

Not every breach looks dramatic. If any of these ring true, treat it seriously:

✗You’re locked out of your email or Microsoft 365
✗Clients or colleagues get messages you never sent
✗A ransom note, or files suddenly encrypted
✗An invoice or payment has been redirected
✗Sign-ins from strange places or devices
✗New mailbox rules hiding or forwarding your email
✗Antivirus switched off, or accounts you don’t recognise

If this sounds familiar, don’t pay anyone and don’t start deleting things — call us first on 0161 738 1399.

How we help

Calm, controlled recovery

Our incident response team works a clear, proven path — we keep you informed in plain English the whole way:

  1. Contain — Isolate affected accounts and devices and cut the attacker’s access.
  2. Investigate — Work out how they got in and what they touched — preserving the evidence.
  3. Eradicate — Remove malware, revoke stolen sessions and close the gaps.
  4. Recover — Restore clean data and safe access, and get you working again.
  5. Harden — MFA, monitoring and training so it doesn’t happen twice.

While you wait

Three things to do right now

  1. Disconnect affected devices from the internet — but don’t wipe anything.
  2. From a clean device, change passwords on your most important accounts (email first).
  3. Note what you’ve seen and when — it helps us trace what happened.

Who we help

Businesses, schools & charities

We help organisations of every kind across the UK — SMEs, schools and academies, charities and hospices — whether you’re a Foresight client or not.

Report it too

Official reporting routes

Alongside getting you safe, report it through the official channels. If money may be at risk, call your bank on a trusted number first.

NCSC response & recovery →Report fraud (Action Fraud) →

Once you’re safe, we’ll help you stay that way — see our managed security (MSSP) and cyber security services.

FAQs

Common questions

I think we’ve been hacked right now — what first?
Call 0161 738 1399. Disconnect affected devices, don’t pay anyone, and don’t delete anything — we’ll guide you from there.
Do you only help businesses in Manchester?
No. We respond remotely to businesses across the UK, usually within the hour, and attend on-site across Greater Manchester and the North West.
How much does incident response cost?
It depends on the incident — we’ll give you a clear idea upfront. Getting you safe comes first.
We’re not a customer — can you still help?
Yes. We help any business in trouble, whether you’re with us or not.
Can you stop it happening again?
Yes — that’s the point. We harden your systems, add 24/7 monitoring through our MSSP/SOC and train your team.

Been hacked? Don’t wait — call us now.

The sooner we’re in, the more we can save. We’re here to help, customer or not.

Call 0161 738 1399Urgent callback