Français
Nederlands
DeutschCyber incident response
Ransomware, intrusion, hacked mailbox or data breach: we help you contain the attack without destroying the evidence, establish what happened and meet your notification deadlines. As a registered court expert in IT and an ISO/IEC 27001 certified firm, we investigate with a method that holds up with an insurer as well as in court.
When to call us
- Ransomware: encrypted files, servers down, a ransom demand or a threat to publish your data.
- Hacked mailbox: unknown forwarding rules, emails sent without your knowledge, a fake-IBAN invoice received by a customer.
- Intrusion reported by your antivirus, your IT provider, a partner or an authority.
- Data leak or theft, or extortion with a threat of publication.
- Unusual activity: accounts created or rights changed without explanation, sign-ins from abroad.
What we take care of
First steps and containment
We guide you in isolating the affected systems and cutting off the attacker's access, without destroying traces the investigation and the insurer will need.
Digital forensics
Entry point, accounts used, timeline, affected systems and data: the facts are established from logs, workstations and servers.
Notifications
Factual input for the early warning to the CCB if you fall under NIS2, the notification to the data protection authority if personal data is affected, the police report and the insurance claim.
Crisis coordination
A single point of contact for your management, IT provider, insurer and lawyer, with regular status updates and documented decisions.
Secure recovery
Before reconnecting, we check with your teams that the attacker's access is closed: accounts, passwords, persistence and patches.
Report and lessons learned
A report designed to be produced to the insurer or in court, and prioritised measures to prevent a recurrence.
How an engagement works
The first hours matter: what is done, or wiped, at that stage shapes the rest of the investigation and the recovery.
First call
You describe the situation. We tell you straight away what to do and what to avoid, then how the engagement will be framed.
Containment and preservation
Isolation of the affected systems, preservation of logs and copies of relevant evidence, with hash values and traceability.
Investigation
Analysis of the traces to establish the entry point, the extent of the attack and the data concerned, in parallel with recovery.
Closure
Report, support for the final reports to the authorities and an action plan approved by management.
Frequently asked questions
What should we do in the first hour?
Disconnect the affected devices from the network (unplug the cable, turn off Wi-Fi) and, if possible, do not switch them off before taking advice. Do not delete or reinstall anything and do not respond to the attacker. Put your backups out of reach, change the passwords of the affected accounts from a clean device, write down the time and what you observed, then call us.
Should we pay the ransom?
The police advise against it: paying guarantees neither that the data will be recovered nor that it will not be published, and it funds criminal activity. The decision rests with your management, together with your insurer and your lawyer; we provide the relevant facts, such as the state of your backups and the extent of the data exfiltrated.
Who must be notified, and by when?
For a significant incident, an entity subject to NIS2 must send the CCB an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. If personal data is affected, the data protection authority must in principle be notified within 72 hours. Financial entities follow the DORA deadlines. Also inform your insurer and report it to the police.
Do you work with our IT provider and our insurer?
Yes. Your provider knows your systems and often handles the recovery; we run the investigation and coordinate with them. If you have cyber insurance, notify the insurer from the start: some policies require their own providers or prior approval.
How much does an engagement cost?
The scope and budget are confirmed in writing at the start of the engagement. With a priority response retainer, these terms are agreed in advance.