When to use this
- A CEO or administrator account shows an unfamiliar login.
- A ransom note appears or files begin changing unexpectedly.
- A mailbox is sending or forwarding messages without authorization.
- A device or server appears infected or under active control.
- A website, cloud service, or business-critical account has been changed unexpectedly.
Start with the event, not the terminology.
Tell Blackpine what changed, what appears affected, whether activity is still happening, and which communication channel is safe to use. Blackpine can triage the situation internally and determine whether response, forensics, recovery, identity, email, malware, or another specialist path is appropriate.
Use a safe email address or callback number if the normal account may be compromised. Preserve relevant evidence where safe and avoid unnecessary destructive changes.
Specialist response services
How Blackpine can be engaged
Pay-as-needed work for organizations that do not have a recurring Blackpine subscription.
Pre-established incident-response relationship intended to reduce contracting and environment-discovery friction during an incident.
Response boundary
Public website intake is for initial triage only. Do not upload passwords, private keys, regulated records, full log exports, confidential client files, or sensitive incident evidence through the public form. Availability and any response commitment are confirmed separately.