Compromised, offline or in a datacentre emergency?

Incident response for datacentres and cloud providers.

When an attacker has root or your customers are offline, you need people who have run hosting platforms, hypervisors and clusters at scale. We contain the incident, recover your services and stay until it is over.

Senior engineers only
5-star reviews since 2008
Retainer with a guaranteed 1-hour response

What we respond to

Security incidents and outages. The same senior engineers handle both.

Security compromise: An attacker has root on a panel, a hypervisor or your billing system. We contain it, find how they got in and what they took, rotate every exposed credential and watch for their return.
Major outage: Customers are down and your team is out of ideas. Senior engineers join your team, find the cause and bring services back in a safe order.
Datacentre emergency: Power loss, flood, fire or a cooling failure. We plan the restart, move or rebuild critical services elsewhere and give you updates to send to your customers.
Storage or cluster failure: Ceph, ZFS or SAN out of quorum, a Proxmox or VMware cluster split, a failed array. Data first. We bring performance back once the data is safe.
Cloud platform failure: A failed region, a deleted account, broken automation or a bad deploy across hundreds of servers. We rebuild from what you have.

How it works

Four steps, with your team. You choose how long we stay.

Tell us what happenedUse the contact form or email us. A senior engineer replies, agrees the scope and the first steps with you, and gets access.
Contain and stabiliseWe stop the damage, keep the evidence and bring the most important services back first.
Recover and hardenWe rotate credentials, close the way in, rebuild what is broken and fix what made it possible.
Watch and hand overMonitoring and alerts on your own systems, then a full report and a handover to your team.

What we do first

Evidence kept before anything changes
Containment: stop the attacker or stop the damage
A plan with owners, for your staff and management
Short updates you can send to customers
A written report on what happened and what we did

Access and your data

We connect the way you choose: your VPN, a jump host or named accounts with MFA
You know the name of every engineer on your systems
Evidence and copies stay encrypted, and we delete them at the end unless you ask us to keep them
NDA on request, before we start

Retainer and quotes

Guaranteed response times are for clients on a retainer.

We offer a retainer with a guaranteed 1-hour response. We quote each retainer for your setup.

Without a retainer, we reply when a senior engineer is free, and we quote the work before we start.

Ask us for a quote

A recent incident

Client name removed. The numbers are real.

44 minto change 4,800 BMC passwords

370+exposure findings on 30 hosts

US hosting provider: attacker with root on the server panel and the hypervisors

Problem: About 5,000 servers in several datacentres. The attacker had root on the server management panel and on hypervisor nodes, read VM disks, took credentials and copied databases.
What we did: In the first 24 hours we mapped the attack, kept the evidence, rotated the panel's agent keys and the switch credentials, started monitoring and changed the out-of-band (IPMI) passwords on about 4,800 servers in 44 minutes. Over the next 3 days we disabled about 3,000 more admin accounts on those servers, audited 30 key systems and found two more systems the attacker had reached.

Built for smaller providers

Large providers have a security team and an on-call rota. Smaller ones have a few senior people, already stretched by the incident. We add senior engineers for as long as you need them.

Who we help

Independent datacentres and colocation providers
Hosting, VPS and dedicated server companies
Cloud and SaaS businesses that run their own servers
Managed service providers with too few senior staff

5-star reviews since 2008

★★★★★ What 400+ clients say about our everyday work.

★★★★★

“AdminGeekZ figured out an issue we've been trying to solve for weeks, in an hour!”

cristianhenao · United States

★★★★★

“Previously I asked five other admins to fix the issue, but none of them succeeded.”

nubisltd · Germany

★★★★★

“AdminGeekZ quickly diagnosed and fixed a complex issue in our older, highly customized order management system.”

rykoproducts · United States

Questions

Have a question we do not answer here? Contact us.

How fast can you start?

Clients on a retainer get a guaranteed 1-hour response. For other incidents, a senior engineer replies when one is free and tells you when work can start. If you need a guaranteed response time, set up a retainer before you need it.

Is this only for security incidents?

No. Outages need the same senior engineers: people who have run datacentres, clusters and hosting platforms. A compromise also needs a careful method to contain, investigate and recover.

Do you replace our team?

No. Your staff know your systems. We join them, lead the response where that helps, do the expert work and leave them the tools, runbooks and monitoring we build.

Can you say who the attacker was?

Sometimes we can show where they came from and what tools they used. We do not promise to name them. We do find how they got in, what they reached and how to keep them out.

What does it cost?

Each incident is different, so we give you a quote before we start. Retainers are quoted for your setup. Ask us for a quote.

Tell us about your incident

Use the contact form, or email sales@admingeekz.com. A senior engineer reads your message and replies.