Incident Response & Cleanup
Something has already gone wrong — a compromised account, a malware infection, a scam. We contain it, clean up, and close the door behind it.
If an account has been taken over, a device is behaving strangely, or money has already moved, the order of operations matters. Doing the obvious thing first — changing the password — can tip off whoever is in there before you have closed the way they got in.
We start by containing it: work out what is actually compromised, cut the access, and stop it reaching the accounts that would make things worse. Then cleanup — removing what is on the devices, recovering the accounts, and revoking the sessions and app permissions that quietly survive a password change.
The initial response covers the first four hours, which resolves most household incidents outright. If yours turns out to need more, we will tell you what is left and what it will cost before doing any of it. You will not get an open-ended bill, and we will not stop halfway.
Prices reflect the time these engagements normally take. Where a service is priced by size, pick the tier matching whichever part of the description is larger for you — a small house with a great many devices belongs in the higher tier. If what we find on the day goes beyond the tier you picked, we will tell you before starting and agree any additional time with you first. We never bill for extra time you have not agreed to.
How it works
Contain
Establish what is compromised and cut off the access, in an order that does not tip off whoever is in there.
Clean up
Remove what is on the devices, recover the accounts, and revoke the lingering sessions and app permissions a password change leaves behind.
Confirm
A follow-up review to verify it is actually closed, and a written record of what happened.