Ransomware help for Kansas City businesses
If a computer at your business may have ransomware, take a few careful steps, then call Blue Tree Technology®. This page explains those first steps. It does not promise that files can be recovered, and it is not a story about a past incident.
What people usually notice
- Files will not open, or their names look wrong.
- A note on the screen asks for payment.
- A shared folder is suddenly unusable.
- Someone reports a program they did not install.
Any one of those signs is a reason to pause and call. You do not need to be sure before you ask for help.
What to do now
- Stop ordinary work on the affected computer. Do not keep opening files on it.
- Separate that computer from the network. Unplug its network cable, or turn off its Wi-Fi. Leave the computer powered on. Do not shut down every computer in the office. Turning a machine off can erase details that show what happened.
- Keep the records on that computer. Do not delete files, clear logs, or wipe and reload the machine.
- Do not click links in a ransom note. If you can read the note without clicking, write down the text.
- Do not pay because of this page. This page does not tell you to pay. Payment is a decision for your leadership, with your own insurer and legal counsel. Paying does not mean the files will come back.
- Write down what people saw and when. Include which computer it was.
- Call Blue Tree Technology®. Clients call support at 816-994-8282. If you are not a client yet, call sales at 816-256-2595. We will tell you whether we can help.
Who to call
Clients: support 816-994-8282
Not a client yet: sales 816-256-2595
You can also use the support center from a computer that is not affected. A free 15-minute discovery call is for a planned conversation, not the first step while an incident is still spreading. The contact form is there when you can write instead of call.
Help desk hours
The help desk is available Monday–Friday, 8 AM–6 PM Central, except holidays. Blue Tree Technology® does not provide 24/7 support. Higher-end plans include extended hours, and after-hours support is for emergency-type issues.
There is no staffed emergency hotline that Blue Tree Technology® people answer around the clock.
What keeps running outside those hours
Automated tools monitor client devices and raise alerts 24 hours a day. Blue Tree Technology® staff do not watch those systems around the clock.
For security issues, managed detection and response (MDR), endpoint detection and response (EDR), and identity threat detection and response (ITDR) include a SOC that watches for those issues and blocks those threats. That SOC is not a Blue Tree Technology® desk for general IT. It is not a promise that ransomware will be stopped or that files will be restored.
How Blue Tree Technology® can help
When you call, we can:
- Help contain the incident so it does not spread to other systems.
- Look at what was affected.
- Restore systems from clean backups where those backups exist and are usable.
- Help you coordinate with the insurer and legal counsel you choose. We do not give legal advice, and we do not decide an insurance claim.
- After the immediate incident, look at changes that make the same path harder to use again.
We do not guarantee recovery. We do not promise a response time. We do not claim a forensic certification on this page.
The same help is summarized on our cybersecurity services page. Disaster recovery planning and data backup and recovery are how you prepare before an incident. Company facts identify Blue Tree Technology®.
Questions people ask first
Who do I call in Kansas City if we think we have ransomware?
If you are a client, call support at 816-994-8282. If you are not a client yet, call sales at 816-256-2595. We will tell you whether we can help. You can also use the support center from a computer that is not affected.
Should we turn all the computers off?
No. Do not shut down every computer. Unplug the network cable or turn off Wi-Fi on the affected computer, and leave that computer powered on. Do not delete files or clear logs.
Should we pay the ransom?
This page does not tell you to pay. Payment is a decision for your leadership, with your own insurer and legal counsel. Paying does not mean the files will come back.
Can Blue Tree Technology® recover our files?
We can restore systems from clean backups where those backups exist and are usable. We do not guarantee recovery, and we do not promise a response time.
Is someone at Blue Tree Technology® available at any hour?
The help desk is available Monday–Friday, 8 AM–6 PM Central, except holidays. Blue Tree Technology® does not provide 24/7 support. Higher-end plans include extended hours, and after-hours support is for emergency-type issues. Automated tools monitor client devices and raise alerts 24 hours a day. Blue Tree Technology® staff do not watch those systems around the clock. For security issues, managed detection and response (MDR), endpoint detection and response (EDR), and identity threat detection and response (ITDR) include a SOC that watches for those issues and blocks those threats. That SOC is not a Blue Tree Technology® desk for general IT.
What should we keep for the investigation?
Leave the affected computer powered on and disconnected from the network. Do not delete files or clear logs. Write down what people saw and when. If you can read the ransom note without clicking a link, keep a copy of the text.
Call, then we will tell you whether we can help
Clients: 816-994-8282. Not a client yet: 816-256-2595.