My Server Got Hacked. What Now?

Decide first whether the system is causing active harm — sending spam, attacking others, or leaking data. If it is, containment such as isolating it at the network level is usually the priority. If it is not, avoid making changes: rebooting, deleting files or reinstalling packages can destroy the evidence needed to understand what happened. Submit the incident details and we will advise on the safest next step.

In many cases, yes. We identify the malicious components and the persistence mechanisms keeping them alive, and remove them where it is safe to do so. For deeply compromised systems we will tell you honestly when rebuilding from a known-good image is the safer choice.

Yes, and we treat the miner as the symptom rather than the problem. Stopping the process is straightforward; the important work is finding how it got there and closing that path, so it does not return within days.

Yes. We review authorised keys across every account, authentication logs, sudo activity and the SSH daemon configuration, then remove unauthorised access and re-establish access on terms you control.

Yes. We review container configuration, exposed sockets, mounted host paths, privileged flags and image provenance, and assess whether the incident stayed inside the container boundary or reached the host.

Not to start. Submit the form with whatever information you have. If hands-on access becomes necessary, we will agree the method with you first and provide secure instructions at that point. Never send credentials through the form or by email.

Usually not before an investigation. A reboot can clear volatile evidence such as running processes and open network connections, and some malicious software is specifically designed to survive it. The exception is when the system is causing immediate harm or data loss.

No, and we will not claim otherwise. Nobody can prove the absence of every possible backdoor on a system that has been compromised. We can tell you what we found, what we removed and how much confidence the evidence supports — and when that confidence is not high enough, we will recommend a rebuild.

Our target is an initial response within 1 hour of receiving your request. That is the first response — a real reply from someone who has read your details — not a resolution time.

An initial assessment starts from €149. Final cost depends on the complexity of the incident, and complex cases may require a custom quote. We will agree scope and cost with you before any substantial work begins.

No. Never send passwords, private SSH keys, API tokens, cloud credentials or database passwords through the form or by email. If secure access is needed later, we will provide instructions for sharing it safely.

You receive an automatic confirmation email immediately. We then review your details and reply personally, with an initial response target of within 1 hour, covering our reading of the situation, what we need from you and the recommended next step.