Hour 0
When a mailbox, site or whole tenant is compromised, the question that decides everything is what the attacker walked out with, and whose data it was. We answer it with numbers a supervisory authority will accept.
An interactive report you can filter by source, category, age and owner. It lists every affected person, what leaked about each of them, and the documents that touch the most people.
What goes to the authority under Article 33, who must be told under Article 34, and the evidence behind each number.
A ready-to-send mail for each person that names the categories exposed but never the data itself, a CSV if you’d rather run the mail-merge yourself, and redacted packages you can hand to the regulator.
What the attacker now knows about your defences, such as passwords, private keys, firewall rules and config files, and what to rotate or rebuild. The DPO gets the notification list; this one is for the CISO.
We don’t investigate how the attacker got in, analyse malware or give legal advice. Your lawyers get the facts from us and form the opinion themselves. The fee depends on how many accounts and sites are in scope, and you’ll know it before we start.
To start, we need a Global Admin (or an on-prem service account), the incident timeline, and one named contact in legal or incident response.
Contact the response team