Dealing with a cyber incident? Let's get it under control.
A compromised mailbox, a hacked account or something that just doesn't look right. I'll help you contain it, find out what happened, clean up and lock things down. It's a same-day emergency line, with a fixed £795 first response.
Do this now
- Don't delete emails, alerts or logs. They show what happened.
- Change the affected password from a different, trusted device.
- Turn on multi-factor authentication if it isn't already.
- If money or bank details are involved, call your bank straight away.
- Call me on 03333 401 999.
What I do
- Contain. Lock the attacker out, end their sessions, and remove hidden forwarding, inbox rules and rogue app access.
- Investigate. Go through sign-in logs and mailbox activity, so you know what was accessed and who was contacted.
- Clean up. Help you warn customers and suppliers, and work out whether the incident needs reporting to the ICO, which has to happen within 72 hours for reportable personal data breaches.
- Lock down. Put the right settings and safeguards in place, and help your team spot the next attempt.
Common situations
- A hacked Microsoft 365 or Google Workspace mailbox.
- Customers receiving fake invoices or bank detail changes from your address.
- Suspicious sign-in alerts or password reset emails you didn't request.
- Someone on the team clicked a phishing link or entered their password.
- Files suddenly encrypted, with a ransomware demand on screen.
What it costs
Incident response starts with a fixed-fee first response of £795. That covers stopping the attack and a preliminary investigation. It's the same price whenever you call. From there, I'll give you a fixed quote for the rest: a full investigation into what happened, what's been affected, recovery and any reporting. Nothing goes ahead until you've agreed it.
Already have an IT provider?
That's fine. I'll work alongside them, and you won't be asked to switch. Once things are safe, Cyber Essentials is a sensible next step, but it's never a condition of getting help.
Incident response questions
Do I have to report a cyber incident?
Not always. If personal data was exposed and it's likely to put people at risk, it must be reported to the ICO within 72 hours of you becoming aware of it. If you've lost money, report it to Report Fraud on 0300 123 2040, or Police Scotland on 101. I'll help you work out what applies.
Is changing the password enough?
Usually not. Attackers often leave inbox rules, forwarding, rogue app access or their own sign-in method behind, and these keep working after a password change. See what to do if your business email is hacked.
Should I tell my cyber insurer?
Yes, and early. Most policies expect prompt notice, and some have their own incident process. I'm happy to work alongside them.
Can you help remotely?
Yes. Most incident work is done remotely, which is how I can start the same day, any day of the week, wherever you are in the UK.
Can you help in the evening or at the weekend?
Yes, evenings and weekends included. The fixed-fee first response is the same £795 whenever you call.
What does the £795 cover?
Stopping the attack and a preliminary investigation, so you know where you stand. Anything beyond that, such as a full investigation, recovery or reporting, is quoted separately and only goes ahead once you've agreed it.
Something wrong right now?
Same-day emergency response, with a fixed £795 first response and a clear quote for anything more.