Account compromise
Preserve the alert and relevant sign-in context, regain control using the authorized recovery process, then review sessions, authentication methods, recovery changes, and privileged actions.
Incident
If an incident is active, start by protecting control and evidence.
This page provides general first actions and an intake path. The public website is not a 24/7 emergency hotline, and Blackpine does not promise an immediate response unless that commitment exists in a separate engagement.
Business email compromise
Protect the mailbox and the business workflows that trusted it. Preserve suspicious messages, forwarding, delegation, sign-ins, and payment or instruction changes.
Ransomware
Prioritize safety, containment, evidence, business continuity, and recovery coordination. Avoid destroying evidence simply to make systems appear clean quickly.
Website compromise
Preserve hosting, deployment, CMS, DNS, and administrator evidence before unnecessary changes. Confirm who controls the domain and recovery paths.
Suspicious administrator activity
Record the account, time, alert source, role changes, high-impact actions, and available logs before sessions or evidence are removed.
Lost or stolen privileged device
Use the organization’s device and identity procedures to revoke relevant access, assess local data exposure, and review credentials or sessions that could survive the device loss.
Use a trusted channel for high-impact verification.
If email itself may be compromised, do not rely on that mailbox alone to verify payment, recovery, legal, or administrative instructions.