Bounce

Incident response

You were attacked and do not know what to do. We help you stop the damage, recover your accounts and devices, keep the evidence and notify whoever the law requires.

Remote incident response: containment, eradication, account and device recovery, evidence preservation and guidance on notifications by jurisdiction.

Duration: Hourly, minimum the first day (8 h)
Start: Within 4 business hours. If it is serious, at any hour

US$190/hour

minimum US$1,520 A short fix is billed US$1,520 even if it takes less time. If it takes longer, it is billed by the hour: US$190 each.

Get help now

Write to us now. Meanwhile, do not switch off devices or delete anything.

It is for you if

You got a ransom demand or your files will not open.
Someone got into your email or your accounts.
You paid a fake account.
You saw something odd and do not know if it is serious.

Is it serious?

It is serious if the damage is happening now and grows with every hour you wait. Then we respond any day, at any hour, all year.

Ransomware: your files are being encrypted or a ransom note appeared.Ransomware: encryption in progress or ransom note.
Money: you sent a transfer to a fake account in the last 72 hours, or payments nobody approved are going out.Money: fraudulent transfer under 72 hours old (the bank can still be asked to stop it) or unauthorized payments in progress.
Accounts taken over: someone else controls the email or account of leadership, payments or an admin, and you cannot get them out.Accounts taken over: active compromise of a privileged or payments account with no way to regain control.
Data: customer data was published or someone is taking it right now.Data: exfiltration in progress or customer data published.
Business stopped: an attack took down your online store or the system you work with.Business stopped: core system or online store down because of an attack.

Not serious: we see it the next business day

A phishing email arrived and nobody clicked.
The antivirus blocked something.
You already got the account back.
You have a suspicion, but you see no damage.

If in doubt, write to us anyway: we decide together on the first call. That 15-minute call is free; we charge from when we start working.

What we do

We stop the damage: we cut off the attacker.Containment: device isolation, session and credential revocation, blocking of forwarding rules.

We recover your accounts and devices.Account recovery (MFA, passwords), guided cleanup or reinstall and restore from backups.

We keep the evidence in case you need it for the police report, the bank or the insurer.Evidence preservation with chain of custody (logs, emails and images where applicable).

We tell you who you must notify and by when, depending on your country.Guidance on mandatory notifications by jurisdiction. It does not replace a lawyer.

We explain what happened and how to stop it happening again.Incident report: timeline, root cause, scope and recommendations.

How we work

First call
What to do now
You tell us what you see and we tell you what to do right away. Those 15 minutes are free.
Triage, first containment steps and signed authorization.
First day
Contain
We cut off access and see how far it got.
Containment, initial scope and evidence preservation.
Following days
Recover
We get everything running again. Before continuing by the hour, we check with you.
Eradication and recovery, hourly with prior notice.
Wrap-up
Report
We hand over what happened and what to change, and go through it together.
Incident report and a 30-minute wrap-up meeting.

What you get

The attack stopped and your accounts back.
Documented containment and recovery.
The evidence kept safe.
Evidence preserved with chain of custody.
Which notices the law requires and by when.
List of notifications by jurisdiction with deadlines.
A report of what happened and how to stop it repeating.
Incident report with root cause.

Scope limits

Includes

Remote response.100% remote response.
The first 8-hour day.Minimum per incident: 8 hours.
Further hours at the same rate, with no after-hours surcharge.Additional hours at the same rate, after hours too.

Does not include

We do not pay the ransom or negotiate with attackers.No ransom payment or negotiation.
We do not come on site: if a device needs hands-on work, we guide you or your technician.Remote only; on-site work is done by the client, guided.
We are not your lawyers: we tell you what the law requires and your lawyer signs the filing.Legal guidance, not representation. Legal advice is a separate offer.
We do not guarantee recovering encrypted files if there is no backup.No decryption guarantee.

Have Burrow? It includes the first day of Bounce for one incident a year.

Questions before you buy

What if it happens on a Sunday night?

If it is serious, we respond anyway. If not, we reply the next business day. If in doubt, write to us and we sort it out on the first call.

How much will it cost?

The first day has a fixed price. After that it is hourly, at the same rate at any hour, and we check with you before continuing.

What do I do while I wait?

Do not switch off devices or delete anything: that is where the evidence is. Unplug the affected device from the cable or wifi and do not pay any ransom.

Were you attacked?

Write to us now. The first call is free and tells you what to do right away.