The article
If something is wrong right now - files will not open, a note demands money, a customer asks about an invoice you never sent - do three things before you read on. Unplug the affected computers from the network, but leave them switched on. Do not wipe, restore or restart anything. Then call +1 (786) 777-9396 or write to talk@26loc.com, and start with the word "incident".
The rest of this page explains how our cybersecurity incident response services work: what happens in the first hours, what we need from you, who may have to be told and what it costs. I have been building software for 18 years. Since 2017 my team of 70+ specialists has delivered 150+ projects, among them apps that store patient photos and take payments, and our clients rate us 5.0 on Clutch from 26 verified reviews (as of September 2026), not one of them negative. In a response, that background matters for one reason: when the attacker came in through the code, the people who close the hole write code every day.
Cybersecurity incident response services: the short version
| What | How it works |
|---|---|
| When to call | As soon as you suspect an attack. You do not need to be sure. |
| What we do | Contain the attack, find out how it got in, remove it, restore your systems and report what happened |
| Who we work with | Your IT people or provider, your lawyers and your insurer's team |
| A new request | Answered within 30 minutes on weekdays, 9:00 to 18:00 Miami time; our delivery team is usually seven hours ahead of Miami, so your early morning is already its working day |
| Price | Estimated before work starts; the first call is free |
| At the end | A written account of what happened and a list of fixes, which our engineers can make |
If an attack at night or on a weekend would hurt you most, set things up before it happens: an agreement made in advance, with the response time written into it, and monitoring that raises an alert at any hour. More on both below.
Why this page starts with the first hour
Before writing this, I read the three pages on incident response services that Google showed first for this search in October 2026; the rest of the first page was tool lists, glossaries and a forum thread. All three describe the same stages, from preparation to lessons learned, and all three recommend a response plan made in advance. None shows a price or a response time in hours. None gives the reader a list of what to do, and what not to do, in the first hour before the responders join.
Three pages are a small sample. Still, the first hour is when a well-meant restart or a quick reinstall erases what the investigation needs, so that hour comes first here.
The first hour: what to do and what to avoid
Print this table and keep it with the list of your accounts. A plan stored only on the network you lost does not help.
| Do | Why |
|---|---|
| Disconnect the affected machines from the network: unplug the cable, turn off Wi-Fi | The attack stops spreading. The FTC's guide for businesses says to take affected equipment offline at once, but not to turn machines off until forensic experts arrive. |
| Leave them powered on, unless you cannot disconnect them | Memory holds traces that a shutdown erases. CISA's ransomware guide advises powering down only when a device cannot be cut off from the network. |
| Talk by phone, not over company email or chat | The attacker may be reading both. CISA advises out-of-band communication, such as phone calls. |
| Write down what you saw: the time, the screen, who noticed, what was clicked | The timeline is where the investigation starts, and memories fade by the evening. |
| Keep what the attacker left: the note, the suspicious email, photos of strange messages on screen | Evidence for the investigation, your insurer and the police. |
| Call your insurer and your lawyer | Your policy and your contracts may set their own steps and deadlines. |
And what to avoid, even when it feels like the responsible thing to do:
- Wiping, reinstalling or restoring from backup before the way in is found. The evidence goes, and a restored system with the same hole lets the attacker back in.
- Paying, answering or bargaining with the attacker before your lawyer and your insurer are part of the decision.
- Announcing anything in public before you know what happened.
- Deleting the phishing email or the logs, or letting old logs be deleted on their usual schedule.
What happens when you call
Our cybersecurity services for incident response follow five steps. The first two overlap: we contain while we learn.
- Contain. We lock the accounts the attacker used, cut off the systems they reached and stop the spread. From you: admin access, or the person who has it, and someone who can decide what may go offline.
- Investigate. How they got in, what they touched and what they took. We read the logs, take images of affected machines before anything changes and keep the evidence intact. From you: the timeline and access to the logs at your cloud, email and software providers.
- Remove. The attacker's accounts and tools come out, and every password and key they could have used is replaced. The FTC's guide puts it plainly: stolen credentials keep a system open even after the hacker's tools are gone. Then the hole they used is closed, in the settings, the server or the code.
- Recover. Systems come back from clean backups, are checked and are watched closely once they are running. If your site has to stay offline for a while, its visitors should see your own page with a phone number, not a bare error. Our own site serves such a page whenever its server does not answer.
- Report. What happened, in plain words for management, and the facts your insurer, your lawyers, regulators and customers need.
How long each step takes depends on how far the attacker got, so I will not quote hours on this page.
Who may need to be told, and by when
An incident that touches personal data can start legal clocks. Here are examples from official sources; your counsel decides which of them apply to you.
| Who | What the rule says | Source |
|---|---|---|
| People in the US whose personal information was exposed | Every state, the District of Columbia, Puerto Rico and the Virgin Islands has a breach notification law; the triggers and deadlines differ | FTC guide for businesses |
| Patients, if you are a HIPAA covered entity | Notice without unreasonable delay and no later than 60 calendar days after the breach is discovered. HHS is told at the same time when 500 or more people are affected; smaller breaches go to HHS within 60 days after the end of the calendar year | HIPAA Breach Notification Rule (HHS) |
| Investors, if your company files reports with the SEC | A material incident goes on Form 8-K, Item 1.05, generally within four business days after the company determines it is material | SEC |
| A data protection authority, if the GDPR applies to you | A reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it | GDPR, as the Irish Data Protection Commission explains it |
| Your insurer and your clients | Whatever your policy and your contracts say | Your own documents |
We do not give legal advice. Our part is the facts every notice is built on: what happened, when, which systems and which data. A notice is only as accurate as the timeline behind it, and the timeline is our job.
Working with your insurer and your lawyers
Read your cyber policy before an incident, or in its first hour. It may ask you to report the incident within a set time, and it may name the responders the insurer pays for. Ask your counsel early how the response should be engaged and who receives the reports.
We work with your lawyers and your insurer's team. The evidence stays in a form they can use, and they get the facts they ask for in writing, without guesses dressed up as findings. On your side, keep a log of every step taken and every cost paid from the first hour on: the claim and the lawyers will both ask for it.
Where the attacker got in decides the fix
The ways in are often ordinary: a reused password without two-factor sign-in, an access key committed to a code repository, a test login code left in production, an admin page that never checks who is asking, a library nobody has updated in years. When the door is a server setting, an IT provider can close it. When the door is in the application, someone has to change the code, test the change and ship it.
That is where a software company earns its place in a response. Our developers fix the hole in the code itself, whoever wrote it, and after the fix the system is tested again to show the hole is really closed. That work continues as cybersecurity remediation and security testing once the incident is over.
Investigations also depend on records. In RxPhoto, a clinic photo platform we worked on, an audit log follows every user action, so an administrator can show who opened which patient record and when. A system without such a log leaves the investigation to guesswork.
Before the next one: what to have ready
The best time to arrange cybersecurity incident response services is before you need them. With an agreement in advance, we already know your systems and your contacts when the call comes. Writing and testing the plan itself is incident response consulting. Whoever helps you, have these ready:
- Names and phone numbers, on paper. Who leads, who decides, your IT provider, your insurer and your lawyer. The network may be the first thing you lose.
- A list of your systems and accounts, with who holds admin access to each. Containment starts from that list.
- Backups you have actually restored, kept where an attacker who takes over your main accounts cannot reach them. Our cloud backup is checked by restoring the copies.
- Logs of sign-ins and admin actions, kept long enough to look back weeks, not hours.
- Two-factor sign-in on email, cloud and admin accounts.
- Someone watching the alerts, your own people or our security monitoring, with tools that raise an alert at any hour.
- A drill. Walk through a realistic incident around a table at least once a year and after every big change in your systems or your team.
What the price depends on
Incident response is estimated before work starts, and the first call is free. The estimate follows:
- How many systems, accounts and locations the attacker reached.
- Whether data left the company, and how much evidence has to be preserved and documented.
- Which reports you need: for management only, or also for an insurer, regulators and customers.
- Whether the way in was in your software, so the fix is a change to the code.
- Whether we already know your systems from an agreement made in advance.
What you are left with
A response closes with the lessons: what failed, what to change and what to watch from now on. You keep the written report and the list of changes, and our engineers can make them, or your team can. For the everyday side of security, from audits to managed security, see our cybersecurity services.
And if something is happening right now, you have read enough. Call or write, and say it is an incident.
