Ransomware support in Belgium
Encrypted systems, a ransom note, maybe a threat to leak your data. Ransomware puts you under heavy pressure. I help you take decisions based on facts, not on the attacker's deadline.
What I help with
- Containing the attack and finding how the attacker got in
- Measuring what was really encrypted and what was really stolen
- Understanding who you are dealing with: the group, its habits, its leak site
- Preparing and supporting any contact with the attacker, if your management decides so
- Tracing cryptocurrency payments
How I work
- 01
Containment and investigation
The incident response starts first: stop the spread, preserve the evidence, find the initial access and the scope.
- 02
Threat actor intelligence
Who is behind the attack, how the group usually behaves, and what it has published or claims to hold.
- 03
Decision support
Your management and legal advisers decide. I give them the facts: what can be restored, what was stolen, and what the options are.
- 04
Negotiation support
If a contact with the attacker is decided, I prepare and support it, in coordination with management and legal. The investigation continues in parallel.
- 05
Recovery and lessons learned
Restore in the right order, close the entry point, and make sure the same attack doesn't work twice.
What you get
- A clear view of the impact: encrypted systems, stolen data, entry point
- Intelligence on the threat actor
- Support for decision-making and, if needed, for negotiation
- Cryptocurrency payment tracing when relevant
- A full incident report and recovery priorities
See an excerpt of a sample incident response reportPDF, 3 pages, in English. Fictitious, anonymised scenario. Request the full 30-page report
Why Cyber Horizon
- Hands-on experience with large-scale ransomware incidents
- Certified in ransomware negotiation and threat intelligence
- Certified in blockchain analysis (Chainalysis Reactor)
- GIAC Security Expert (GSE #433)
Frequently asked questions
Should we pay the ransom?
That decision belongs to your management and legal advisers, never to the technical team alone. Paying guarantees nothing: decryption can fail, and stolen data can still be leaked. My role is to give you the facts to decide.
Can you decrypt our files?
Sometimes a free decryptor exists for older or flawed ransomware, and that is always checked. Most often, recovery relies on intact backups, which is why protecting them comes first.
Should we report the attack?
Filing a complaint with the police and notifying the Centre for Cybersecurity Belgium (CCB) is recommended, and some organisations are legally required to notify. Check your obligations with your legal adviser.
Does my cyber insurance cover this?
Check your policy and contact your insurer early: many policies have their own procedures and approved providers. I can coordinate with them and share the report.
What is the link with incident response?
Ransomware support comes on top of incident response: the investigation and recovery always run, whatever happens with the attacker.