In short: If you suspect that data has leaked through your website, time is the decisive factor. If you are affected, get in touch immediately. Remotely, we secure the evidence, clarify technically which data may be affected, close the access and deliver reliable documentation for the data protection officer, lawyer and insurer.
Do not delete anything and do not rebuild anything right now. Logs, database and files are the only evidence of what has leaked and what has not. Anyone who overwrites them cannot prove anything later. Report an emergency and we take over from the first message.
Are You Affected? How to Recognize a Data Breach via the Website
A data leak often happens unnoticed. Clues usually come from side effects:
- Customers report that data only you had is appearing elsewhere, or that they receive phishing emails with correct order details.
- The database is under conspicuously heavy load, or exports and dumps are sitting in places where you did not put them.
- The logs show mass queries on customer lists, orders or user profiles, often at a regular rhythm.
- Your server makes outgoing connections to addresses you do not know, or transfers an unusual amount of data.
- There are new admin accounts, changed passwords or logins at unusual times.
- A security researcher, a journalist or an authority points out openly accessible data to you.
- Unprotected backups,
.envfiles or directories that anyone can open are on your server.
The last point is a leak without an attack: anyone who leaves a backup file in the web directory makes data retrievable without any hack. That, too, may have to be reported.
What to Do Right Now
- Record the time: Note when and how you learned of the suspicion. That moment matters for the deadlines.
- Limit access: Take affected areas, such as customer accounts or export functions, temporarily offline or into maintenance mode if data could still be leaking.
- Secure the evidence: Do not change server logs, database or file system. Ask the host to keep logs.
- Involve the data protection officer: Inform the responsible person internally, or an external data protection officer, so that the notification deadline stays in view.
- Clarify the data types affected: What is on the system? Customer master data, orders, health or payment data, job applications?
- Change access details, but in coordination: Change passwords and keys only after consultation and from a clean device.
- Inform the insurer and a lawyer: Many policies require early notification.
How Does PHP SOS Help?
- Assess the situation: We clarify with you which systems and data types may be affected and when the suspicion arose.
- Secure and close: We secure logs, database and files unchanged, block the attacker's access and close open routes, such as unprotected backups.
- Check and clean up: We analyze access, database queries and connections, look for webshells and backdoors and remove them. Where necessary, we bring in partners for court-proof IT forensics.
- Harden and report: You receive a timeline, a statement on the data that was probably affected, clearly separated into proven, probable and unknown, and recommendations for long-term protection.
We work remotely, with no travel, across Germany and Europe.
Notification Deadline: What the GDPR Requires and What We Contribute
Under Art. 33 GDPR, a personal data breach must in principle be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, if it is likely to result in a risk to those affected. This is general information, not legal advice. Whether and what you must report, you decide with your data protection officer or a lawyer.
Our contribution is the technical side: what happened, which systems were affected, which data types were stored there, how long was the access open, what was done? A notification based on proven facts rather than assumptions is easier to defend. An overview of the duties is given on the page about the GDPR notification duty within 72 hours. An incident does not get smaller over time; anyone who reports early and documents cleanly has the advantage.
Securing Evidence and Addressing Those Affected Properly
The biggest danger after a leak is the reflex to repair everything quickly. A freshly built server looks nice but proves nothing any more. How to proceed without destroying traces is described in Secure evidence before you reinstall. The sequence of events can afterward be recorded in an incident timeline.
If customers or partners have to be informed, clear, factual words matter. Suggestions are provided by Informing customers after an incident and the page on crisis communication. Whether a criminal complaint makes sense, you clarify with your lawyer; notes on the contact points are under Reporting to the police. If the incident spreads to several systems, we move together into structured incident response.
What You Should Send Us
- a short account: when did you notice something, through whom, by what?
- the data types stored on the website or the server
- access to the server, or permission to talk directly to your host
- information on backups, exports and interfaces to other systems
- names of the agency and developers who know the system
- the name of the data protection officer, if there is one
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You have one contact, everything is documented, and we say openly what can be proven and what cannot. We promise no reconstruction when the logs are missing, and no legal advice. We supply the technical facts with which you and your advisers can decide.
Affected? Call Us. We Help.
With a possible data breach a deadline is running, and the traces disappear with every day. Get in touch now: call us or write to us on WhatsApp. We take over from the first message and stay with you until the incident is closed and documented. Report an emergency now
Frequently asked questions
How quickly must I report a data breach?
Under Art. 33 GDPR, a personal data breach that poses a risk to those affected must in principle be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Whether that applies in your case, you clarify with your data protection officer or a lawyer.
How do I know whether data has really leaked?
Often only by analyzing server logs, database access and outgoing connections. If those traces are missing, the leak can be neither proven nor ruled out. We state that openly in the report as unknown.
Do I have to inform my customers?
That depends on the risk to those affected. If it is high, they must also be notified under the GDPR. The legal assessment belongs with the data protection officer or a lawyer; we supply the technical basis for it.
What happens if I only notice later that data is gone?
What matters is when you learned of the breach. Record when and how the suspicion arose, and secure the evidence from that point on.
Can you also help if the data was held by a service provider?
We check what we can clarify with the access and information you obtain. We coordinate with the agency or host once you release us to do so.