In short: Affected? Call us. We help. After a hacker attack on your company, what you need most as management is one contact who takes over the technical part so that you can make decisions. We work remotely, preserve evidence, close the entry point, clean up and document until the incident is closed.
Do not delete anything and do not rebuild anything right now. Ask your IT team and your host not to change anything for the time being, either. Tidying up in the heat of the moment destroys evidence that you need for insurance, data protection and the police. Report an emergency and we take over from the first message.
Are You Affected? How Management Notices an Attack
A hacker attack rarely begins with a report from IT. Often the first clue comes from outside:
- A customer or business partner reports a strange email, a redirect or a browser warning.
- The host blocks the website or writes that malicious code was found.
- The website shows foreign content or spam, or behaves differently than usual.
- Your IT team reports unknown files, accounts or processes on the web server.
- There is an extortion demand, an offer of your data online or a message from authorities.
An attack can also be present without a clear sign. Since the PHP vulnerabilities PHP2Shell were published, the BSI (German Federal Office for Information Security) has been warning at warning level 3 / orange; attack attempts have been observed according to Cloudflare and Patchstack. We are glad to clarify whether your company is affected, without your having to prove the suspicion. Technical signs are listed under Am I already compromised?.
What to Do Right Now
- Name a decision maker. One person may decide for the company on shutdowns, restarts and password changes, and is reachable.
- Have nothing changed. No deleting, no reinstalling, no restoring of backups before the evidence is secured.
- Write the situation down briefly. What was noticed, when and by whom? Which systems and data could be affected?
- Inform the data protection officer. If personal data is affected, a deadline may be running. Read about it in the GDPR notification duty.
- Check with the insurer. If you have a cyber policy, it often regulates when and how you must report the loss. What matters is described in Cyber insurance in the event of a claim.
- Agree on external messaging. Who talks to customers, press and employees? The page Crisis communication after an attack helps with this.
- Get in touch now. Call us or write to us on WhatsApp.
What Management Must Decide and What We Take Over
A hacker attack is a technical and a business event. The decisions stay with you; we can carry the technical work.
| Question | Responsible |
|---|---|
| Is the website or shop temporarily switched off? | You decide; we show consequences and alternatives |
| Has data leaked, and which? | We supply the technical facts from logs and files |
| Is there a reporting duty? | Data protection officer or lawyer, with our report |
| Is a criminal complaint filed? | You decide; we secure the evidence beforehand |
| How are customers informed? | You, with communication specialists; we supply the facts |
| How does the server come back clean? | We do, coordinated with your IT |
We give no legal advice on the liability of management for security gaps; general information is under Liability of management. The page on the Central Contact Points for Cybercrime makes the decision on a criminal complaint easier.
Think Business Operations and the Incident Together
Besides the technology, the question of how the business keeps running is pressing in the first hours. If orders, appointment bookings or purchases depend on the website, operations need an interim solution: a maintenance page with a phone number, a form on a clean system, or handling by phone and email. According to media reports, authorities took their sites offline as a precaution during the PHP2Shell situation and stayed reachable by phone and email; that shows that shutting down and remaining reachable can go together.
Talk to your staff as well. Anyone who knows about the incident will not fall for the phishing emails that are often sent in its wake, and will not give outside information that later looks contradictory. Keep statements about the incident short and verifiable. Assumptions do not belong in a customer email; what we know for certain, what we assume and what is open, we separate explicitly in our report.
How Does PHP SOS Help?
- Assess the situation: In an initial conversation we clarify what is known, which systems may be affected and what is stored on them. You receive a short assessment with the next steps.
- Secure and close: Files, database and logs are secured before anything is changed. Then we contain the attack and close the entry point, with PHP2Shell by patching and restarting all processes.
- Check and clean up: We look for backdoors, foreign access and manipulated files and clean up. Where necessary, we rebuild from trustworthy sources.
- Harden and report: You receive a report that data protection, insurers and business partners can read, plus recommendations for the time afterward.
If the incident grows beyond one server, we move into structured incident response. If court-proof investigation is needed, we bring in specialized partners for IT forensics.
What You Should Send Us
- The name and contact details of the decision maker in the company
- A short account: what was noticed, when, by whom?
- Details of the affected system and of the host or service provider
- Information on any existing cyber insurance and the responsible data protection contact
- Access to the server, or permission to talk directly to your host
Why PHP SOS
We work Made in Germany and, together with our partner network of cyber professionals, have specialized in IT security for over 25 years. You get one contact instead of a waiting queue. We work remotely, with no travel, across Germany and Europe. Every step is documented, also so that you can substantiate to insurers, data protection and business partners what happened. We tell you openly what is proven and what is only probable, and we promise nothing that nobody can deliver. What an incident can cost is described on the page Cost items of a hack.
Affected? Call Us. We Help.
The earlier the evidence is secured, the more can be substantiated later. We take over from the first message and stay with you until the incident is closed and documented. Report an emergency now.
Frequently asked questions
Hacker attack on the company: what should management do first?
Name one person as decision maker and contact, delete or rebuild nothing, and get technical help. In parallel, the data protection officer and, if you have one, the cyber insurer should be informed. We clarify the technical situation with you.
When does a hacker attack have to be reported?
If personal data is affected, a notification to the data protection authority within 72 hours may be required. Whether the duty applies is assessed by the data protection officer or lawyers. We supply the technical facts for it.
Should I file a criminal complaint after a hacker attack?
Many companies do, partly because insurers or business partners expect it. The German police have Central Contact Points for Cybercrime for this purpose. To keep evidence usable, traces should be secured beforehand.
Does our company need a service provider if we have our own IT?
Often yes. In-house IT knows normal operations but less often evidence preservation and cleanup after a break-in. We work with your IT and take over the part for which experience or time is lacking in-house.
What does a hacker attack cost the company?
That depends on duration, the data involved and business interruption. Typical cost items are listed on our page about the costs of a hack. We do not name a figure without knowing your situation.