Incident response after a hack, remote or on site.
Has your website, computer or backup been hacked, or have you been scammed? We step in to contain the attack, find how the attacker got in and measure what was exposed. Then we restore your systems and confirm the hole is actually closed. On site in Rouen, France and the surrounding area, remote everywhere else.
At a glance
- ScopeWebsites and web applications, workstations and servers running Windows or GNU/Linux/Unix, backups, connected devices. Plus fraud and scams.
- Where we workAt your offices or your home, in Rouen and the surrounding area. Remotely everywhere else.
- Who forIndividuals, businesses and nonprofits.
- What you getA diagnosis and a quote before any work starts, then an incident report for the police complaint, your insurer and, if needed, the CNIL.
We handle
- Web applications
- Windows and GNU/Linux
- Backups
- Connected devices
- Fraud and scams
Restoring isn't enough. You have to close the door.
A backup puts back the system as it was before the attack, along with the hole that let the attacker in. As long as it stays open, they can come back.
The first instinct is often to wipe everything and reinstall. The machine or the site runs again, but nobody knows how the attacker got in, what they left behind, or what they took.
The traces answer those questions: system and server logs, modified files, new accounts, installed programs. We collect them before cleaning up, so we know what to fix and what to tell you about the exposed data.
Finding security holes is what we do every day, in penetration tests and in bug bounty. We know how attackers get in because that's exactly what we look for, and we confirm the fix by attacking the way in again.
Site restored, hole still open
Three days after the restore, the same request drops an executable file on the server again.
After our response
Plugin patched, planted files removed, credentials changed: the same request goes nowhere.
An example on a website. Flip the card to see the response.
What to do first, right now.
What you can do right away, without erasing what will tell us how the attacker got in.
Isolate, don't erase
Disconnect the device from the network, cable and Wi-Fi, without turning it off, or put the site in maintenance mode. Don't delete or reinstall anything: it's evidence.
Change your credentials
Passwords for the affected accounts, your email and your admin panels, from a clean device. Turn on two-factor authentication.
Tell the right people
Your IT provider or your host. Your bank right away, if you paid or gave out your card or bank details.
Keep evidence
Screenshots, messages received, the ransom note, the numbers and addresses used, with the date and time.
Don't pay, report it
No ransom: nothing guarantees you'll get your data back. In France, the government's 17Cyber service walks you through it, and you file a complaint with the police or gendarmerie.
What we handle.
From the website to the office computer, for businesses and individuals alike. Here are the systems we work on, and where each attack settles in.
Websites and web applications
A defaced site, redirects to other sites, a A file hidden among the site's own, which lets the attacker come back whenever they want, even after a password change. hidden in the files, a tampered checkout page, an API used by a stranger.
Workstations and servers
Running Windows or GNU/Linux/Unix: viruses, A program that encrypts your files so you can't open them, then demands a ransom., remote takeover, an unknown admin account, a machine quietly attacking other systems.
Backups
Backups encrypted, wiped or never tested: we look for what can be restored, then set up a backup the next attack can't reach.
Connected devices
Camera, router, printer, network storage: accessed by a stranger, factory password never changed, exposed on the internet or hijacked to attack others.
Fraud and scams
Fake tech support, phishing, fake bank advisor, fake bank details, webcam blackmail: advice, a check of your devices and help with the next steps. See how we help.
Exposed data
Customer files copied, mailboxes read, backups downloaded: we measure what got out, and since when.
After a scam, the right moves.
Fake tech support, fake bank advisor, phishing, fake bank details: the scammer is after your money, your codes or your card details. We help you understand what happened, protect your accounts and devices, and take the right steps.
Understand what happened
Which scam it was, and what the scammer got: a code, access to your computer, your card or bank details.
Check your devices
If the scammer had you install remote control software, as in a fake tech support scam, we remove it and make sure nothing else was left on the machine.
Secure your accounts
Email, online banking, online accounts: passwords changed, two-factor authentication on, unknown sessions closed.
Take the next steps
Calling your bank to block the card or dispute a payment or transfer, filing a police complaint, running the diagnosis on 17Cyber. In France, the Info Escroqueries line also answers at 0 805 805 817, free of charge.
A common scam. The link leads to a fake site that collects card details. The card needs to be blocked as fast as possible.
How a response works.
Six steps, from the first conversation to everything running again. Nothing starts without your written approval.
- 01
First conversation
You tell us what you're seeing and since when. We give you the steps that limit the damage right away, and tell you whether the incident falls within our field. This first conversation is free, with no commitment.
- 02
Diagnosis and quote
You get a diagnosis describing the problem and the work needed, and a quote with the timeline, the price and, if it applies, the travel. If a first technical look is needed to write it, we tell you up front how that works.
- 03
Contain the attack
With your written approval, we isolate what needs isolating: a machine unplugged from the network, the site in maintenance mode, suspicious accounts disabled, credentials changed. A copy of the hacked state is kept for the investigation and the complaint.
- 04
Find the way in
System and server logs, modified files, installed programs, new accounts: we trace the attacker's path back and measure what was viewed or copied.
- 05
Clean up and fix
Malware and backdoors removed, the hole fixed, the system reinstalled or restored from a clean backup, credentials rotated. We work with your IT provider, host or agency if you have one.
- 06
Verify and get back to work
Before anything goes back into service, we attack the way in again to confirm it's closed, and we check that the backup actually restores. Then you get the incident report, and we walk through it with you in a debrief.
At your place or remotely.
Depending on the incident, we work on site with you or remotely with the access we need. We decide together in the first conversation.
On site, in Rouen and nearby
We come to your offices or your home to work on your computers, servers, backups and connected devices, with you and your team.
Remotely, everywhere else
With secure remote access to your machines or your hosting, much of the work gets done without travel. We agree on which access to open, and you close it again at the end.
With your vendors
IT provider, host, web agency, developer: we hand them exactly what needs fixing, with the evidence, or we fix it alongside them.
On site in Rouen and the surrounding area. Everywhere else, we work remotely, with secure access to your machines or your hosting.
We're listed on Cybermalveillance.gouv.fr, France's national assistance service for victims of cyberattacks. A victim can find us there and be put in touch with us.
About the serviceThe incident report you receive.
What happened, in plain words and backed by evidence. It serves your team, your insurer and, when needed, the police complaint and the CNIL.
The timeline
What happened and when, from the first trace to everything running again.
The way in
How the attacker got in, and why it was possible.
What was exposed
The data viewed or copied, the accounts affected, and what we can't rule out.
What was done
Every action taken during the response, and the state of your systems when we closed it out.
What's left to do
The recommended measures, ranked by priority, so a similar incident doesn't happen again.
Debrief
A session to go over everything with you and the people who run your systems.
A sample timeline. Every line of the report rests on the traces collected during the response.
What it costs.
Quoted after a diagnosis: a fake tech support scam and an encrypted server don't take the same work.
What the quote spells out
The work planned, the timeline, the price and, if it applies, the travel. You also know who to contact and how to reach us during the response.
If a first technical look is needed to write the quote, we tell you up front how that works.
If the length, the nature or the cost of the work changes along the way, we tell you and wait for your written approval before going further.
The first conversation is free, with no commitment.
Nothing starts without your written approval. Not the work, and not any change along the way.
Do you come to us?
Yes, in Rouen and the surrounding area, to your offices or your home. When the incident calls for it, we work on site on your computers, servers, backups and connected devices. Everywhere else, we work remotely, with secure access to your machines or your hosting.
Which systems do you handle?
Websites and web applications, workstations and servers running Windows or GNU/Linux/Unix, backups and connected devices. We also offer advice and assistance after fraud or a scam. If your incident falls outside that scope, we tell you in the first conversation and point you to the right provider.
What should we do with the affected device or site?
Disconnect the device from the network, cable and Wi-Fi, without turning it off: its memory holds traces the investigation needs. For a website, put it in maintenance mode or ask your host to isolate it. Don't delete or reinstall anything before we step in.
Should we pay the ransom?
No. Nothing guarantees you'll get your data back or that it won't be published, and paying funds the attackers. Keep the ransom note as evidence. We look for what can be restored from your backups.
I fell for a scam. Can you help?
Yes. If the scammer got access to your computer, we remove the software they had you install and check the machine. We help you secure your accounts and take the next steps: calling your bank to block the card or dispute a payment, filing a police complaint, reporting the scam. In France, the Info Escroqueries line also answers at 0 805 805 817, free of charge.
Should we file a police report?
Yes, we recommend it, ideally before reinstalling the affected devices, to preserve the evidence. In France, you file a complaint with the police, the gendarmerie, or in writing with the public prosecutor. The government's 17Cyber service walks you through it. Our incident report lays out the facts and gathers the evidence.
Personal data leaked. What now?
Under the GDPR, if the breach poses a risk to the people involved, it must be reported to the CNIL, France's data protection authority, without undue delay and where possible within 72 hours of becoming aware of it. If the risk is high, those people must be told as well. Either way, the incident must be documented internally. Our report establishes what was viewed or copied, so you decide based on facts.
Should we tell our insurer?
Yes, as soon as you can. In France, if your policy covers cyberattacks, the law makes compensation conditional on a police complaint filed within 72 hours of becoming aware of the attack. The incident report documents the claim.
After the incident, the other doors.
One closed hole doesn't mean there are no others. On your websites and web applications, an audit looks for them before an attacker does.
Website security audit
Brochure site, store or CMS: everything your site exposes online, from public pages to forgotten subdomains.
See the serviceWordPress penetration testing
Plugins, themes, roles and the admin area: the WordPress ecosystem, tested with an approach of its own.
See the serviceAPI security audit
If the attack came through an API, its other routes may apply the same loose rules.
See the serviceWeb penetration testing
For a business application, a complex customer area or a SaaS, with several roles and workflows to get through.
See the serviceHacked or scammed? Write to us.
Has your website been hacked?
Tell us what you're seeing and since when. We reply with the first steps, then a diagnosis and a quote. The first conversation is free, with no commitment.