Case study · Incident response · 2026
E-mail marketing SaaS platform, compromised. DFIR report accepted by DNSC, platform back online and protected.
Client: Romanian e-mail marketing service provider, with active business clients across the country. The client's name and sensitive technical details are omitted from this material.
The situation
An attack that took the platform down and locked clients out
The platform, used by clients for e-mail campaigns to their own contact databases, became unavailable following a cyberattack. The operator had no internal security team and no response procedures. At stake were service availability, the personal data in the clients' contact databases and the notification obligations towards DNSC and ANSPDCP, with deadlines running from the first hour.
NIW was called in as the external response team. We started work before the contract was signed, on the basis of the offer, because legal deadlines do not wait.
The mandate
Two components, clearly separated
Component A: investigation, stopping the attack, reporting. Evidence preservation, forensic analysis, identification of the vector and the extent of the compromise, the DFIR report and the legal notifications.
Component B: remediation and hardening. The recovery plan, platform hardening, perimeter protection and support for reconnecting clients.
The price was set at the lower end of the market, based on a market study of DFIR services in Romania.
Timeline of the intervention
Five phases, three fronts in parallel
Triage
Mobilisation and isolation
Out-of-hours connection, assessment of the extent, isolation of the affected systems without destroying evidence. Clear instructions for the client: what not to touch, what not to restart.
Evidence
Preservation and forensic acquisition
System images, export of system, application and access logs, configuration snapshots. Documented chain of custody for every artefact.
Analysis
Reconstructing the attack
Timeline of events, initial access vector, compromised accounts and systems, data accessed. The conclusions underpinned both the DFIR report and the personal data impact assessment for ANSPDCP.
Reporting
DNSC and ANSPDCP
DFIR report drafted in the format expected by DNSC, accompanied by the hardening and recovery plan. DNSC accepted the report and the plan in full, with no further requirements. The notification to ANSPDCP was filed on time; the file is under review at the authority.
Recovery
Hardening, going back online, support
The platform was brought back into service behind WAF and anti-DDoS protection configured and managed by NIW. The security changes affected the authentication of existing clients, so NIW took over the reconnection support line, with daily interventions until stabilisation.
Capabilities demonstrated
What we had to know how to do, all at the same time
| Area | Capability | How it showed in this incident |
|---|---|---|
| Incident response | Out-of-hours mobilisation and triage | More than half of the 400+ hours were on an emergency or out-of-hours basis |
| Digital forensics | Evidence preservation, chain of custody, log and image analysis | Complete reconstruction of the timeline and the attack vector |
| Legal reporting | DFIR report in DNSC format | Accepted in full, with no further requirements |
| Compliance | Notifications under OUG 155/2024 and GDPR art. 33 | Filed on time with DNSC and ANSPDCP |
| Security architecture | Hardening and recovery plan | Accepted by DNSC together with the report |
| Perimeter protection | WAF, anti-DDoS, managed DNS/CDN | Configured by NIW, still managed by NIW |
| Platform operation | Technical administration of a legacy SaaS platform | Stabilisation, daily support for reconnecting clients |
| Crisis management | Communication with management, shareholders and the platform's clients | Interim reports, hours documented through access logs |
Lessons
What would have cut the cost of the incident to a fraction
- MFA on all administrative access and on the platform's control panel.
- Centralised log collection with sufficient retention: without it, reconstructing the attack takes several times longer.
- WAF / anti-DDoS protection before, not after.
- Verified backup, separate from the production infrastructure.
- A written incident response procedure, with an external contact already under contract.