What it is
Cloud services keep your data, but they also copy mistakes and attacks instantly. A hijacked account can delete mailboxes; ransomware on one laptop can encrypt the folders a whole team syncs.
We work through the provider’s version and retention layers, its audit logs and your synced devices to bring the data back, then secure every account involved.
Signs you need this
- Mailboxes, OneDrive or Google Drive files deleted
- Synced folders encrypted for several users at once
- A compromised admin or user account
- Retention or backup settings changed without approval
What we do
Secure accounts
Revoke sessions, reset credentials and remove access the attacker granted.
Restore
Recover from version history, retention and recycle layers, and from synced devices.
Review
Check audit logs to confirm what was accessed, changed or exported.
What you get
- Restored mailboxes, files and sites
- Secured accounts and a list of the access removed
- Audit-log findings on what the attacker touched
What we need from you
- Admin access to the tenant, or the person who has it
- Which users and services are affected
- When the problem was noticed
Questions
Doesn’t the provider back everything up?
Only for a limited period, and mainly against its own failures. Deleted or encrypted data usually has to be recovered by you, within retention windows.
How quickly do we need to act?
As soon as possible. Retention periods expire, and the sooner we start, the more we can restore.