Incident response

If you think your organisation has had a security incident, here are the first steps and the ways to reach us.

Call us

Have your organisation's name and a short description of what you are seeing ready.

If you cannot call, email info@wavecyber.co.zm, or use the form below. For anything urgent, a phone call is faster.

These steps apply to ransomware, a compromised account, phishing, or unusual activity on your network.

Disconnect the device, but leave it on

Unplug the affected device from the network (Wi-Fi and cable) to stop the problem spreading. Do not shut it down, because that can destroy evidence.
Contact us

Tell us what you have noticed, such as strange logins, locked files, a ransom note, or emails sent from your account that you did not send.
Keep the evidence

Do not delete emails, files or logs, and do not try to clean up the system yourself. Screenshots of anything unusual are useful.
Change passwords from a different, clean device

Start with email, banking and administrator accounts, once we have confirmed which systems are safe to use.
Tell the right people inside your organisation

Let your IT lead and management know. If personal data may be involved, we can help you work out your duties under the Zambia Data Protection Act, 2021.

For an active incident please call. This form is not watched continuously.

Incident details

Your name

Organisation (optional)

Phone number

Give a phone number or an email address, or both.

Email address

How urgent is it?

What are you seeing?

Please do not put passwords, keys or other credentials, or other people's personal details, in this box. We will ask for what we need when we speak.

You are welcome to call and ask. We can help you work out whether it needs a response.