Skip to main content

Healthcare Firm — 2026-Jun-21

Healthcare Firm

Respond to a major website compromise discovered during a planned infrastructure modernization: contain the intrusion, restore essential services, and set a course to rebuild on a hardened, code-free platform.

  • Identified an active web backdoor and hosting-account compromise through log analysis, confirming it pre-dated the engagement
  • Contained the intrusion by disabling server-side code execution and serving a safe maintenance page, ending the outage without reactivating malicious code
  • Restored inbound and outbound email, replaced an expired TLS certificate, and added missing email authentication
  • Scoped credential rotation and a rebuild as a modern static site with no server-side code, eliminating the entire attack class

Related projects