Hired a hacker — what to do next

Hired a hacker

Hired a hacker is a search people make after the fact. Sometimes it means a company completed a real pentest and wants to understand the report. More often, in this keyword cluster, it means they paid a stranger to access a phone, an email, or a wallet, and now they have neither the access nor the money. This article is for both groups, with different next steps.

If you hired a legitimate firm and you have a report, the next problem is usually operational: severity arguments, a retest, or a board slide. Contact us if you want a second pair of eyes on a document you are allowed to share, or if you want the follow-on test scoped properly. Bring the statement of work and the findings, not a screenshot of a chat.

If you hired someone off an advert who promised phone access, social-account takeovers, or crypto recovery, assume two things until proven otherwise. One: they did not do the thing. Two: they now have your name, your story, and often more credentials than they should. Rotate passwords from a clean device. Tell your bank if you paid by card or transfer. Tell the police if a crime was proposed or funds were taken. Do not send a ‘final unlock fee’.

We will not finish an illegal brief that another vendor abandoned. We will not ‘take over the hack’. We will not recover the deposit they stole by hacking them. If, after that episode, you still have a lawful problem — a product that needs testing, a company estate that needs a real assessment, a breach of systems you own — contact us and start clean. New scope, new authorization, named operators.

A small number of ‘I hired a hacker’ messages are from people who authorised a test and then panicked when production wobbled. That is why a kill switch and a daily control channel exist. If that is you, call the emergency contact on the RoE first, then us if we are the firm, or your original vendor if we are not.

Contact us and start clean

Write to us with the problem you have today, not the one the last person sold you. If it is a phone you do not own, stolen coins on someone else’s chain, or an account that is not yours, we will decline and point you at the institutions that can actually act. If it is an application, a network, or an incident inside your company, we will send a scoping note. That is the entire difference between ‘hired a hacker’ as folklore and hiring this lab.