Email account taken over, invoices redirected, files encrypted. We get called in to clean up breaches for businesses that are not our clients, and we have done it dozens of times since 2017.
Most of the damage in a breach happens in the first few hours. These steps limit it without destroying the evidence we need.
A staff mailbox signed into from overseas, hidden forwarding rules, phishing sent to your clients from your own address. We lock the attacker out and find everything they did.
A supplier's or client's "new bank details" that weren't theirs. We work out where the request came from, whose mailbox was used and what else was sent.
Files encrypted and a ransom note. We contain the spread, work out what was affected and restore from backups where they exist.
Rogue admin accounts, consented apps you didn't approve, settings changed. We take back control and review every account and app.
A laptop or phone with client data on it. We lock and wipe it where possible and work out what was on it.
Odd sign-in alerts, clients asking about strange emails, a bounce you didn't expect. Call anyway. A short call is often all it takes to rule it in or out.
We ask what happened, tell you what to do next, confirm the cost and start. Often within the same call.
Lock the attacker out: reset credentials, revoke sessions, remove their rules, apps and access, isolate affected devices.
Rebuild the timeline from your Microsoft 365 audit and sign-in logs: how they got in, what they read, what they sent and to whom.
Warn the people who were targeted. Give you the facts you need for your insurer and for any notifiable data breach assessment.
Fix what let them in, then a written incident report: what happened, what we did and what to change.
We are not lawyers. Whether a breach must be reported to the OAIC under the Notifiable Data Breaches scheme is your decision, with your lawyer's advice. We give you the facts of what happened so that decision can be made quickly.
Call 1300 384 736 and you're put through to an engineer. Charged at our standard hourly rate, confirmed on the call before any work starts.
Call the same number. Our answering service takes your details and confirms the after-hours minimum, then an Evisent engineer calls you back. After-hours work is charged at double our standard rate.
Afterwards, there is no obligation. If you'd like to stop it happening again, a Live Audit shows where your Microsoft 365 tenant stands, and Managed IT includes 24/7 monitoring.
No. We are often called in to clean up breaches for businesses that aren't our clients. The job ends when you're secure, with no retainer and no lock-in.
Yes. We can work alongside your provider, or run the incident ourselves and hand back a written report they can act on.
Call your insurer as well as us. Many policies require you to tell them early, and some have their own response team. We work alongside them and give them what they need.
Yes. Many of the businesses we help don't have cover. We confirm the cost on the first call so there are no surprises.
It depends on what personal information was involved and whether the Privacy Act covers your business. We work out what was accessed and give you the facts. Whether to notify is your decision, with your lawyer's advice.
We can't promise that, and no one honestly can. Calling your bank straight away matters most. We give you and your bank the evidence of what happened, quickly.
Call now. If it turns out to be nothing, we'll tell you.