Company network hacked
Unknown access inside the network, locked accounts, unusual traffic. We contain the intrusion, examine domain controllers and credentials and close the entry point.
IT emergency line for the Heinsberg district
Cyber emergency?Has your company been hacked?
Stay calm: the first minutes decide how much damage remains. Wasacon from Heinsberg stops attacks in progress, preserves evidence and brings your systems back into operation in an orderly way.
- Availability
- Around the clock in an emergency
- Access
- Remote at once, on site when needed
- Your contact
- Oleg Wasa, directly
First aid in an IT emergency
What you should do NOW
Five steps before anyone starts repairing. They take a few minutes and preserve evidence, data and backups.
-
Step 1: Stop using the affected devices
Do not log in, do not open anything, do not experiment. Every action can overwrite traces or help the malware along.
-
Step 2: Disconnect affected systems from the network as far as possible
Pull network cables, disconnect Wi-Fi, cut remote access. Avoid switching machines off: a running system holds volatile evidence.
-
Step 3: Do not delete suspicious files or messages
Leave emails, files and alerts untouched. Even a ransom note is a piece of evidence.
-
Step 4: Do not rush to reset or reinstall systems
A hasty reinstall destroys the traces that reveal the entry point and the extent of the attack, and it can endanger intact backups.
-
Step 5: Contact an IT emergency service
Describe briefly what happened and how many systems are affected. We will agree the order of the next steps together.
And right after that:
In an acute case, calling is the fastest way.
Situations we take over
Emergencies Wasacon helps with
Every incident follows its own pattern. These are the situations we handle most often, on site in the Heinsberg district and remotely beyond it.
Ransomware and encrypted data
Files are encrypted and a ransom note has appeared. We isolate affected systems, protect the backups and assess the recovery options with you.
Microsoft 365 or email account hacked
Foreign sign-ins, new forwarding rules, mails sent in your name. We lock accounts, remove rules, review sign-in logs and secure the accounts.
Server compromised
Windows Server, Active Directory, NAS or virtual environments behave suspiciously. We examine services, accounts and shares and separate compromised systems from the rest.
Website hacked
Defaced pages, malicious code, spam sending or browser warnings. We take the site offline in a controlled way, clean it and close the exploited gap.
Passwords and credentials stolen
Credentials surface in the wrong hands or in a leak. We reset in an orderly sequence, starting with the critical accounts, and switch on a second layer of protection.
Suspected data leak
Internal data is circulating outside the company. We establish which systems are affected and where the data came from, and document the findings verifiably.
Phishing and CEO fraud
A deceptively genuine mail, a supposed instruction from the boss, a payment to the wrong account. We check what was clicked and secure accounts and payment paths.
Malware and trojans
A machine behaves strangely, the antivirus raises alerts, something unknown runs in the background. We analyse the infection, remove it and check whether it has spread.
Your situation is not listed? Report it anyway.
Report a cyber emergencyHow the response runs
IT forensics and incident response
An emergency response follows a fixed sequence. The goal is to stop the attack, preserve evidence and bring operations back in an orderly way.
-
Assessment
What is affected, since when, what is still running? A first picture and a clear order of steps emerge on the phone within minutes.
-
Containment
Compromised systems are isolated, credentials locked, attackers shut out. The damage stops growing.
-
Forensic analysis
Logs, accounts and systems are examined: entry point, time frame, affected data. Traces are preserved before they disappear.
-
Clean-up
Malware and backdoors are removed, systems are rebuilt where necessary, and access is reissued cleanly.
-
Recovery and report
Operations return to the network step by step. You receive comprehensible documentation of the incident and the measures taken.
In the middle of an incident? Report the situation and we take over the sequencing.
Report a cyber emergencyThe direct line
Report a cyber emergency
Describe briefly what happened. In an acute case calling is fastest, and the form reaches us as well.
- Phone
- +49 2452 860 83 73
- info@wasacon.com
- Address
- Am Diebsweg 22, 52525 Heinsberg
- Service area
- Kreis Heinsberg
- Around the clock in an emergency
- The IT emergency line is also open to companies that Wasacon does not yet look after.
Back into operation
Backup and recovery
After the attack, what matters is what can be restored cleanly. We check backups before anyone touches them and rebuild in the right order.
Verify the backups
Are the backups complete, readable and free of malware? We establish that before any restore begins, so that nothing infected comes back.
Set the order
First the systems the business depends on: order processing, email, telephony. Then the rest, in sequence rather than all at once.
Restore cleanly
Rebuilding on cleaned or freshly installed systems, with new credentials and closed gaps, so the attacker does not move back in.
Secure the restart
After the restart we verify that everything is there and stays there: data, permissions, backup runs. Only then is the incident technically closed.
Unsure about your backups? That is exactly where we start.
Report a cyber emergencyWhen data is affected
GDPR: support with a data protection incident
If personal data could be affected, you quickly need a reliable picture. Wasacon supports you with the technical assessment and documentation of a possible data protection incident.
Wasacon provides technical support and documentation help, not legal advice.
Unsure whether data is affected? The analysis settles that.
Technical assessment
Which systems and data were reachable, over what period, by what route? We compile the technical facts on which every further evaluation is built.
Documentation
Timeline, affected systems, measures taken: a comprehensible basis for your internal evaluation and your reporting channels.
Groundwork for your specialists
The GDPR sets short deadlines for notifiable incidents. The legal evaluation rests with your data protection officer or legal counsel, and we supply the technical basis for it.
Harden instead of hope
After the attack: so it does not happen again
The second attack often hits the same gap. After recovery we harden the environment exactly where the incident showed it to be vulnerable.
Multi-factor authentication
Stolen passwords lose their value when every sign-in needs a second factor. We introduce MFA where it counts.
Firewall and secure access
Rules that match the business, VPN instead of open ports, controlled remote access. What is reachable from outside becomes a deliberate decision.
Network segmentation
Whoever reaches one segment no longer reaches everything. Production, administration and guests are separated, critical systems especially.
Backup concept
Backups following the 3-2-1 rule, one copy of them immutable, and restores that are tested rather than merely configured.
Monitoring and EDR
Endpoints and network are monitored continuously, so that a new attempt is noticed while it is still small.
Rather before than in the middle of it? Ask for a review of your environment.
Report a cyber emergencyWhere we operate
Service area: the Heinsberg district
The office is in Heinsberg and remote access is available at once. On site we cover the whole district.
Towns in the service area
- Heinsberg
- Erkelenz
- Hückelhoven
- Wegberg
- Geilenkirchen
- Wassenberg
- Gangelt
- Linnich
Just outside the district? Call anyway, distance does not matter for remote access.
- Office
- Wasacon IT-Dienstleistungen
Am Diebsweg 22, 52525 Heinsberg - Phone
- +49 2452 860 83 73
Answered briefly
Plain answers: frequent questions in an emergency
The questions that come first in a crisis, answered before you have to search.
Not hastily. Payment guarantees neither decryption nor the deletion of copied data, and it finances the next attack. We first check what backups and known decryption tools can deliver, and we recommend reporting the incident to the police.
Disconnect yes, switch off preferably not. A running system holds volatile traces that a forensic analysis needs. Pull the network cable and leave the machine on until specialists take over.
Typical signs are sign-ins at unusual times, locked accounts, new forwarding rules in mailboxes, suddenly slow systems, antivirus warnings, or files that have been moved or encrypted. When in doubt, call briefly and the check brings clarity.
That depends on the extent and cannot be stated seriously as a flat figure. In the first conversation we narrow down the situation and the approach, so you know what to expect before anything starts.
Yes. A great deal can be contained and analysed remotely at once. When hands on the machine are needed, we come to your site anywhere in the Heinsberg district.
Yes. The IT emergency line is also open to companies that Wasacon does not yet look after. Whether ongoing support follows after the response is entirely your decision.
That depends on the data affected. If personal data is involved, the GDPR sets short deadlines for notification. The decision rests with your data protection officer or legal counsel, and we supply the technical documentation for it.