Don't delete anything
Don't reinstall the system and don't delete files. Otherwise you lose the traces that show the cause and the extent.
Emergency help
Under attack or facing an open vulnerability? Call us.
For companies whose website, shop or software has been attacked or is affected by a known security vulnerability. You will speak to Akan Yüzügüzel, founder of DevAbo. Available around the clock. Monday to Friday from 8:00 to 18:00 (German time) we usually get back to you within 15 minutes, at other times within one hour, including nights, weekends and public holidays.
- Contract and project management in Mannheim
- Two developers per system
- Liability insurance with Hiscox
Warning signs
How you can often tell you have been attacked
- Your site shows content or ads you didn't put there, or redirects to other sites.
- Google, your hosting provider or a virus scanner warns about your site.
- Unknown user accounts, files or orders appear.
- Your hosting provider blocks the site or reports malicious code.
- Customers report suspicious emails sent from your domain.
- A security advisory concerns software you use, such as PHP2Shell in October 2026.
Before you call
Four things that help in the first few minutes
Insurer first
If you have cyber insurance, call their emergency hotline first. Many policies require this before a service provider steps in.
No passwords by email
Don't send credentials by email or chat. We agree on a secure way on the phone.
Note the times
Write down when you noticed what. This helps with finding the cause and with any reporting obligations.
Process
How an emergency engagement works
-
Call
Mon–Fri 8:00–18:00 we usually get back to you within 15 minutes, at other times within one hour. You tell us what has happened. We clarify who commissions us and who is allowed to grant access.
-
Preserve evidence
Before we change anything, we secure logs and files. That keeps the traces for your insurer, reporting obligations and the search for the cause.
-
Contain and restore
As far as the state of the system allows, we lock affected accounts, close the vulnerability and restore operations.
-
Report and plan
You receive in writing what happened, what we did and what to do next to reduce the risk.
To be clear
What we promise and what we don't
Honest about the result
After an attack, nobody can seriously promise that every trace of malicious code will be found. We tell you openly what we find, what we fix and what remains uncertain.
Reporting obligations
For a report under the GDPR, which can be due within 72 hours, or under NIS2, we provide the technical facts. Whether and to whom you have to report is for your data protection officer or your lawyer to decide.
Access only with a mandate
We only start working on your system once an authorised person has commissioned us in text form; an email is enough. Before we begin, we confirm it by calling back, where possible on a number we verify independently of your website, for example from the commercial register, a contract or an invoice. That way we check whether the instruction comes from you.
Report in writing
Prefer to write?
Briefly describe what has happened. We answer written requests within one business day (Mon–Fri). For the fastest help, call us.
- Emergency
- +49 173 4250811
- info@dev-abo.de
- Address
- DevAbo · Y&L Solutions
Rahnfelsstraße 10
68163 Mannheim
Germany