Containment
Stop the spread and stabilize what is still running. The first decisions are which systems stay online, which come off the network, and which accounts get locked. We make those calls with your operators, not around them.
Incident response · 24/7
Incident Response
If a breach is underway, call (714) 794-2803. The line is open 24 hours a day, 7 days a week. GRYHAT is based in Mission Viejo and answers for Orange County and California businesses. Call and you get a local team.
Or email eva@gryhat.com if the event is already contained and you want to scope support.
Containment
Evidence handling
Recovery
Written record
The first hour
Do these in order. None of them require a specialist on site before you dial.
- 01
Call
Dial (714) 794-2803. Say what you are seeing, which systems are involved, and whether they are still on the network.
- 02
Leave them on
Keep affected machines powered on when it is safe. Memory and logs are evidence. Cutting power can erase both.
- 03
Isolate, do not wipe
Unplug the network cable or disable Wi-Fi. Do not reimage, do not run a cleaner, and do not delete files to tidy the scene.
- 04
Write it down
Note the clock time, what changed, and who has touched the systems since you noticed. A short timeline beats a reconstruction later.
- 05
Hold the announcements
Pause public statements, customer notices, and any ransom payment until you have spoken with us and with your counsel.
What GRYHAT does
Forensic-grade evidence
Evidence is handled with forensic-grade care. We preserve what counsel, insurers, and a later review will ask for, before cleanup erases it. Preservation comes before a tidy desktop.
Eradication and recovery
Once the scene is held, we remove what does not belong and bring systems back on a documented path. Recovery is part of the engagement, not a separate project you discover on day three.
A record others can use
You get a written account of what happened, what was contained, and how recovery was done. We coordinate the technical side of notices your counsel and insurer require. Legal advice stays with your counsel.
Straight answers
What should we do in the first hour?+
Call (714) 794-2803 and say what you are seeing. Leave affected machines powered on when it is safe, disconnect them from the network without wiping them, and write down the time plus who has touched the systems. Hold public statements, customer notices, and any ransom payment until you have spoken with GRYHAT and with your counsel.
What does GRYHAT do on an incident?+
We contain the event, handle evidence with forensic-grade care, and work eradication and recovery with a written record. That record is what leadership, counsel, and insurers ask for. We coordinate the technical side of those notifications. We do not replace your lawyer.
Can we reach you at night and on weekends?+
Yes. (714) 794-2803 is open 24 hours, 7 days a week, including nights and weekends. It is the same number as the rest of the site. Call and you get the local Mission Viejo team.
Should we shut everything down or wipe the machines?+
No, not as a first move. Powering off can erase memory and logs. Reimaging, cleaner tools, and deleting files destroy the evidence you will need. Isolate the machine from the network and leave it on when that is safe. If a system is actively harming people or other networks, say so on the call and we will take that in order.
Do you replace our IT team?+
No. We work with the operators you already have. Your team knows the business. We bring containment, evidence handling, and a recovery path they can execute with us.
The line is open
If you are in it right now, call. If you are preparing before anything happens, book a time or write us and we will scope the work with you.
Andy V·eva@gryhat.com
