Qualification
Immediate callback: how the leak was discovered, which systems are involved, what data is stored there.
Data breach — 72-hour deadline
Data breach? the 72-hour clock is ticking
Determine what has actually been exfiltrated, stop the leak, and build a defensible case.
- Qualify the actual scope: what data, how many people, since when
- Seal the leak and verify that no access remains open
- Immediate callback — no obligation, no online payment
Critical incident? Call now+33 7 82 70 38 30
or leave your contact details:
An expert will call you back in under 5 minutes
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
150+
audited companies
SINCE 2016
72 h
first response
INCIDENT RESPONSE
1 247
vulnerabilities reported
ALL AUDITS
Included
re-test after correction
ALL OFFERS
The deadline has already started
GDPR gives you 72 hours
The deadline for notifying the CNIL starts from the moment you become aware of the breach, not from when you have understood it. Notifying without having established the scope exposes you as much as not notifying at all.
- You must be able to state which data categories are concerned and how many people are affected.
- An approximate notification is difficult to correct: it commits your organization to specific facts.
- If the data is already circulating, discovering it yourself is better than a customer informing you.
- As long as the cause is not identified, there is no guarantee that the leak has been stopped.
- The breach register is mandatory, even when notification is not.
We intervene on the technical aspect: origin, scope, evidence, remediation. Legal decisions and the final drafting of the notification remain the responsibility of your counsel or your DPO.
Intervention
What we establish before the deadline
The goal in the first few hours is not to know everything: it's to know enough to make decisions and notify accurately.
Actual Scope
Analysis of logs and access to determine what was consulted or extracted, by whom, and over what period.
Patching
Closing the access path, revoking exposed credentials, verifying that no persistent access remains.
File
Timestamped technical summary: timeline, scope, measures taken. The document your DPO or lawyer will rely on.
While awaiting our call
First Steps data breach
- Note precisely the date and time you became aware of the breach: the 72-hour deadline starts from then.
- Do not delete anything, especially logs: they will be crucial for establishing the scope.
- Cut off the affected access (exposed database, sharing link, compromised account) without reinstalling the system.
- Revoke any credentials, API tokens, and keys that may have been exposed.
- If data is already circulating, keep proof of its dissemination (URL, screenshots, timestamps).
- Open your breach register and start filling it out, even if notification has not yet been decided.
What our clients say
We don't rate ourselves.
Reviews published on our Google listing by companies that have actually been audited. Verifiable, one by one.
GOOGLE
We hired White-Hat to conduct a cybersecurity audit of all our servers, and we are very satisfied with the quality of their work. Philippe demonstrated professionalism, responsiveness, and excellent communication skills throughout the entire process. The recommendations provided were clear, relevant, and immediately actionable to strengthen our security. We highly recommend their services.
GOOGLE
Excellent experience with White-Hat for a comprehensive security audit of our SaaS platform. The quality of service was truly outstanding: Philippe took the time to understand our application's architecture before starting the tests, which made all the difference to the relevance of the results. The report was detailed, with vulnerabilities categorized by criticality, concrete evidence of exploitability, and recommendations directly applicable by our technical team. The post-delivery follow-up to verify the patches was a real bonus. Professional, rigorous, and attentive: exactly what you need to secure a SaaS product.
GOOGLE
We hired White-Hat for a comprehensive audit/advanced penetration test on our website, and it's clearly the direct contact with Philippe that makes all the difference. No salesperson between us, no unnecessary jargon: we communicate directly with someone who understands our challenges and can clearly explain the vulnerabilities found. The report was precise, with concrete evidence and recommendations that we were able to implement quickly. A truly trustworthy relationship; I highly recommend them.
GOOGLE
Professional work. Thank you.
GOOGLE
We urgently contacted White Hat following a suspected compromise of several servers. The team was extremely responsive and addressed our request within minutes, with clear communication at every stage. Their vulnerability analysis was conducted very rigorously, resulting in a detailed report and concrete, easy-to-implement recommendations to strengthen our security. The investigation of the compromised servers allowed them to quickly identify the source of the attack and contain the incident without any major disruption to our services. Professional, knowledgeable, and readily available, I highly recommend this provider for any cybersecurity intervention, especially in emergency situations.
Scope
We intervene on
Situations handled
Exposed database, publicly accessible backup or storage space, compromised email or CRM, customer file in circulation, exfiltration after intrusion.
What we produce
Timestamped timeline, scope of affected data, categories of individuals impacted, identified cause, corrective measures applied.
Out of scope
We are not a law firm: legal qualification, the decision to notify, and final drafting are the responsibility of your counsel or your DPO. We provide them with the technical material.
Dedicated Contact
Philippe Bécué data breach
Database exposed online, backup accessible without a password, hijacked administrator account, customer file found in circulation: breaches rarely stem from a spectacular attack. Philippe Bécué traces the origin, measures what was actually exfiltrated, and provides you with a solid report – not a cautious estimate that leaves you notifying blindly.
FAQ
Leak Data
When does the 72-hour period start?
From the moment the breach is known, not from its full understanding or occurrence. This is why it's crucial to precisely timestamp the discovery and start documenting immediately.
Do we need to notify in all cases?
No. Notification to the CNIL depends on the risk to the individuals concerned, and informing individuals themselves has an even stricter criterion. However, registration in the breach register is required in all cases. Your DPO or lawyer will decide, based on the technical elements we establish.
Can you draft the notification?
We provide the technical part: timeline, scope, cause, measures. Drafting and sending are the responsibility of your organization and its counsel — we do not substitute for a lawyer.
What if we don't know what was exfiltrated?
This is the most frequent scenario, and it's precisely our job: to reconstruct from logs, configurations, and access traces what might have been consulted or extracted. When certainty cannot be reached, we state it and define the most unfavorable hypothesis.
Act
Data Leak — get a callback now
Describe the incident in one sentence. We'll call you back and tell you what to do immediately — free and no obligation.
Free, confidential, no obligation — no online payment.