Start with the type of problem, not the first search result
When a Central Florida business needs cybersecurity help, the hardest part may be identifying the right starting point. A suspicious email, a compromised account, a fraudulent wire, a ransomware event, and a compliance question require different actions. Search results can also lead to impersonation sites, paid “recovery” services, or providers making claims that are difficult to verify.
A safer route begins with official sources. Use government websites for reporting, preservation, and baseline guidance. Use the affected technology vendor for account-specific support. Use qualified professional help when the issue requires investigation, restoration, legal analysis, or regulated-data advice.
If money may have moved, contact the bank first
For a suspected business email compromise, altered invoice, fraudulent wire, or unauthorized payment, call the financial institution immediately using a trusted number. Do not rely on the phone number in the suspicious message.
Preserve the original email, headers if available, payment instructions, timestamps, account details, and messages exchanged with the sender. Ask the bank about recall or freeze procedures. Speed matters operationally, although no source can guarantee recovery.
The FBI’s Internet Crime Complaint Center, or IC3, accepts reports of cyber-enabled crime and fraud at ic3.gov. The FBI says prompt reporting can support investigative and recovery efforts. A report is not a substitute for contacting the bank or local law enforcement, and it does not guarantee that funds will be recovered.
Be alert for follow-on scams. The FBI has warned that criminals impersonate IC3 and offer paid recovery assistance. Use the legitimate IC3 website and be skeptical of anyone who asks for money to recover funds while claiming to represent law enforcement.
If systems or accounts appear compromised
Use the affected vendor’s official support channel and your internal incident plan. For Microsoft, Google, a payroll provider, a payment processor, or a specialized practice-management platform, start from the vendor’s known website or contract documentation rather than an unsolicited support number.
Immediate actions may include:
- Signing out active sessions.
- Resetting the affected password from a clean device.
- Revoking suspicious application permissions or sessions.
- Preserving audit logs before changing settings when practical.
- Removing unauthorized forwarding rules or mailbox delegates.
- Disabling a compromised account while preserving evidence.
- Checking whether other accounts share the same password.
The exact sequence depends on the service and incident. Avoid deleting evidence or rebuilding every device before a qualified responder has considered containment and preservation needs.
If ransomware or broad disruption is suspected
CISA’s #StopRansomware guidance recommends isolating impacted systems, using the organization’s incident response plan, preserving information, coordinating communications, and reporting to appropriate authorities. If several systems are affected, the office may need to take a network segment offline. Do not let staff continue using potentially affected systems simply because the office needs to remain open.
Contact, as applicable:
- Your managed service provider or internal IT lead.
- Your cyber insurance carrier and its approved breach-response panel.
- CISA for federal cybersecurity assistance and guidance.
- The FBI or IC3 for criminal reporting.
- Your local law enforcement agency.
- Legal counsel and privacy or regulatory advisors when sensitive information may be involved.
The business should maintain out-of-band contact methods because email may be unavailable or monitored. Keep an offline or separately protected copy of critical phone numbers and escalation instructions.
Florida-specific reporting and support
The Florida Department of Law Enforcement operates a Cybercrime Office with a statewide mission that includes investigating complex cybercrimes, assisting state, regional, and local investigations, training investigators, and sharing information with the public. FDLE provides a cybercrime reporting route and notes that life-threatening emergencies should go to 911.
This resource is especially relevant when the matter involves suspected criminal conduct in Florida. It does not replace the FBI’s IC3 process, local police reporting, the bank’s fraud team, or the business’s legal and insurance obligations.
For prevention and planning, NIST’s CSF 2.0 Small Business Quick Start Guide is a useful national resource. It organizes work into Govern, Identify, Protect, Detect, Respond, and Recover. The FTC also maintains small-business guidance covering updates, backups, multifactor authentication, vendor access, training, incident response, and other baseline practices.
Industry-specific routes
Different industries should add their own official regulators and contractual contacts:
- Medical offices should review applicable HIPAA obligations with qualified privacy and security counsel or a compliance professional.
- Financial offices should determine whether the FTC Safeguards Rule or another regulatory framework applies.
- Contractors should review customer, insurance, and government-contract requirements before assuming a general checklist is sufficient.
- Professional offices should map client-data duties, records-retention rules, and breach-notification responsibilities.
- Retail and service businesses should coordinate with payment processors and banks when card data or payment credentials may be involved.
The existence of a resource does not prove that it applies to a particular organization. Confirm scope, deadlines, definitions, and reporting thresholds directly from the relevant authority.
A verification checklist before calling for help
- Confirm the website domain and use bookmarked official pages.
- Verify the provider through an existing contract or independently known phone number.
- Ask what evidence, logs, and records should be preserved.
- Confirm who owns decisions and who may authorize containment.
- Record the time, contact, instructions, and case number for each report.
- Avoid paying an unknown “recovery” service before independent verification.
- Tell employees where to report suspicious messages and payment changes.
What is confirmed and what is uncertain
Confirmed: the FBI, IC3, CISA, FDLE, NIST, and FTC publish official routes and guidance for different parts of cyber response and prevention. Confirmed: no single agency or vendor handles every business obligation.
Uncertain: the correct reporting mix depends on what happened, what information was involved, where the business operates, which contracts apply, and whether money moved. A resource route helps organize the first call; it does not determine legal conclusions or guarantee technical recovery.
The most credible starting point is usually the one that matches the event, uses a verified contact path, and preserves the facts needed for the next decision.