Emergency phoneline: 936 940 176
A direct contact channel to activate the incident response protocol, whether you are already a Seintec client or need external help for the first time.
Cybersecurity
Incident Response: Regain Control After a Cyberattack
A 24/7 emergency service to contain, analyse, and eradicate security threats, restore operations, and meet notification obligations. Available for both existing and new clients.
- 24/7 emergency response
- Containment and eradication
- Analysis and recovery
- Notification support
What is an incident response service?
An incident response service is a set of technical and procedural actions used to manage an IT security breach, such as a ransomware attack, unauthorised access, or a data leak. The primary goal is to minimise the attack's impact, limit the damage, and restore business operations as quickly as possible.
This is a reactive service activated at the point of crisis. Our team follows a proven methodology to contain the threat, investigate its origin and scope, eradicate it from your systems, and finally, recover data and services. The final phase focuses on drawing lessons learned to strengthen your defences and prevent future incidents.
Service Coverage
What our incident management includes
With over 15 years' experience, our team works in a coordinated manner to cover all critical response phases, minimising the impact on your business and providing essential visibility during a crisis.
Technical Response
- Threat containment to prevent propagation.
- Forensic analysis to identify the origin and scope.
- Eradication of malware or unauthorised access.
- Secure recovery of systems and data from backups.
Support and Compliance
- Guidance throughout the decision-making process.
- Technical support for notifying authorities (AEPD, INCIBE-CERT).
- Documentation of all actions taken.
- Analysis of lessons learned to strengthen security.
24/7 Emergency Service
Immediate support for new and existing clients
A security incident doesn't wait for office hours. Our emergency phoneline is available 365 days a year to provide an initial response and mobilise the necessary resources.
Triage and initial containment
The first step is to assess the situation and apply immediate containment measures to limit the damage while a more in-depth intervention is prepared.
Responsibilities
A coordinated effort: who does what
Resolving an incident effectively requires close collaboration. We clearly define roles to ensure a swift response and avoid misunderstandings.
Seintec's responsibilities
Executing technical containment, analysis, and eradication. Advising on the recovery strategy. Providing the technical information required for notifications to official bodies and insurance companies. Leading the technical investigation and recommending improvements.
The client's responsibilities
Providing access to the affected systems and all available information about the incident. Making key business decisions (e.g., restoration priorities, employee communication). Acting as the primary contact for communications with the AEPD and other authorities.
Service Scope
Limitations and important considerations
Our goal is to restore normality, but certain factors can affect the outcome. We believe in being transparent from the very beginning.
- We cannot guarantee data recovery without viable, tested, and uncompromised backups.
- The service does not include paying ransoms in ransomware cases or negotiating with cybercriminals.
- The legal responsibility to notify the AEPD within 72 hours lies with the client; Seintec provides the technical support to substantiate this notification.
- Response and action times are defined by contract or under the terms of our emergency service for non-clients.
- Recovery may be subject to dependencies on third parties (e.g., software vendors, connectivity providers), which we will coordinate but do not control.
What makes us different
In-house technical team and a single point of contact
In a crisis, communication and trust are paramount. We do not outsource our incident response. The same Seintec technical team, based in Osona (Barcelona) with over 15 years' experience, handles the process from start to finish.
Because we don't rely on intermediaries, the chain of command is short and decision-making is agile. You will have a single point of contact who coordinates all actions and keeps you informed, simplifying management during a high-stress situation.
Our infrastructure, which includes our own data centre in Sant Miquel de Balenyà (Osona), gives us an additional layer of control when an incident affects services we host, allowing for direct action on the hardware and network.
The phases of our incident response
- 01
1. Containment
We isolate affected systems to prevent the threat from spreading to other parts of the network. This is the first step in regaining control and limiting damage.
- 02
2. Analysis and Identification
We investigate the origin, nature, and scope of the attack. We determine which systems and data have been compromised to plan the next steps.
- 03
3. Eradication
We securely remove the root cause of the incident—be it malware, compromised credentials, or exploited vulnerabilities—from all affected systems.
- 04
4. Recovery and Restoration
We restore systems and data to a secure operational state from verified backups. We validate that everything is working correctly before returning to production.
- 05
5. Lessons Learned
We produce a post-incident report detailing the cause, the actions taken, and recommendations to strengthen security and prevent a recurrence.
Frequently Asked Questions about Incident Response
We've been attacked. Do you help companies that aren't existing clients?
Yes. Our 24/7 emergency service on 936 940 176 is available to companies that do not have a service agreement with Seintec. We will assess the situation and propose an immediate action plan.
What happens when I call the emergency number?
A qualified technician will take your call to perform an initial assessment (triage) of the incident. Based on its severity, the response team will be activated to begin containment tasks as soon as possible.
Can you guarantee you'll recover all my data?
The ability to recover data depends entirely on the existence and state of your backups. Our work focuses on using viable backups to restore your services. We cannot recover data that was never backed up or whose backups have been compromised.
If my personal data has been leaked, do you notify the AEPD on my behalf?
The legal obligation to notify the Spanish Data Protection Agency (AEPD) within 72 hours falls to your company, as the data controller. Our role is to provide you with the support and detailed technical information about the breach so you can make that notification on a fully-informed basis.
Does this service prevent attacks?
This is a reactive service, designed to act *after* an incident has occurred. However, the 'lessons learned' phase generates key recommendations to improve your defences. For prevention, we offer other services such as security audits or SOC/MDR monitoring.
How long does it take to resolve an incident?
The timescale varies widely and depends on the complexity of the attack, the size of the infrastructure, and the quality of the backups. Our goal is to restore critical operations as quickly as possible, but a full recovery can take anywhere from a few hours to several days.
Related services to strengthen your security
Next step
Need urgent help or want to be prepared?
If you are currently experiencing an incident, call our emergency phoneline now. If you're looking to strengthen your response plan, request a free review of your current infrastructure and preparedness.