Services · Incident response
Something is wrong. Ring first, delete nothing.
If your website has been hacked, is redirecting visitors somewhere strange, or is sending spam in your name, we contain it, clean it, work out how they got in, and close the door behind them.
If it is happening now
- Ring 1300 856 393. Say what you are seeing and when you first noticed.
- Do not delete files or restore a backup yet. The evidence of how they got in is what stops it happening again.
- Write down what you saw. The warning, the strange page, the customer who rang, and the times. Times matter.
- If anyone is demanding payment, talk to us before you reply.
You will recognise it
- Visitors are sent somewhere else. Your pages redirect to scams, pharmacies or casinos, often only on mobile or only from search results.
- Search results look wrong. Google shows pages you never wrote, or warns people away from your site.
- Accounts you did not create. A new administrator, a user you do not recognise, a password that no longer works.
- Email you did not send. Customers receive messages from your address, or your mail starts bouncing as spam.
- Your host has stepped in. The account is suspended, throttled, or flagged for sending malware.
Not our first rodeo
We have been building and defending websites since 1996. Hacked sites, visitors redirected to scams, spam sent in someone else’s name, strangers in the admin panel: we have seen them, cleaned them up and found how they got in. The panic is new to you. The problem is not new to us.
The Essential Eight is a great framework, and you should be working towards it. But frameworks are for the quiet months. When it hits the fan, we are the nerds who turn up with umbrellas and cleaning supplies, so the people defending your business get room to breathe and think. What we do from there stays between us and you.
This work gets niche fast. When a problem needs a specialist we are not, we bring in people from a network of nerds we know and trust. You keep one point of contact: us.
The part nobody mentions
A hacked website can be a legal problem as well as a technical one.
If the breach touched personal information and your business is covered by the Privacy Act, the Notifiable Data Breaches scheme applies. You must take reasonable steps to assess a suspected breach within 30 days, and if serious harm is likely, notify the OAIC and the people affected as soon as practicable.
If your business turns over more than $3 million a year and a ransom or extortion payment is made, it must be reported to the Australian Signals Directorate within 72 hours of making it.
We are not your lawyers. What we give you is the technical record those decisions depend on: what was accessed, when, and how. The people who advise you are then working from facts rather than guesses.
What we do
What it costs
From$700inc GST
Worked in two-hour blocks.
If an incident needs more than the first block, you hear that from us before the hours are spent, with what we have found so far. Sites on our monthly maintenance plan have malware cleanup included.
Who does the work
Led by someone who attacks for a living. Luke Elin, who leads Ey3, has spent thirty-five years in databases, web development and cyber security, and works as a red teamer. Thinking like the attacker is how you find the second door, the one they left for coming back.
You also get the same people from the first call to the final explanation. No ticket queue, no handover. If you want to report it to the Australian Signals Directorate as well, ReportCyber is the place, and we will help you fill it in with the facts.
Common questions
Should I restore a backup?
Can you work out how they got in?
Is my email affected too?
Do I have to report it?
How do we stop it happening again?
Next step
Ring now. We will tell you what to do first.
If it turns out to be nothing, you will know quickly. If it is something, it stops being yours to carry alone.