A French team that finds what others missed. And stays with you afterwards.
Online stores, SMEs, local authorities: we restore your site, then help you put in place the practices that stop it happening again.
A persistent reinfection on a PrestaShop store.
One of our engagements, presented to illustrate our method.
- Reconstruct the incident
- Identify injections and the entry point
- Monitor after remediation
Which platform are you on?
Each platform has its own attack vectors, persistence mechanisms and control points. Our playbooks are platform-specific — not a generic scan.
WooCommerce
Vulnerable plugins, tampered themes, brute-forced admin accounts.
Emergency page →PrestaShop
Compromised modules, template injections, fraudulent payment modules.
Emergency page →Magento / Adobe Commerce
Payment card skimming at checkout, hijacked integrations and tokens.
Emergency page →Shopify
Malicious apps, hijacked staff accounts, tampered themes.
Emergency page →A persistent reinfection on a PrestaShop store.
One of our engagements, presented to illustrate our method.
In June 2026, a French furniture store running PrestaShop is hacked. The insurer appoints a specialist provider, who deploys a detection tool on the server. For seven weeks, the infections keep coming back. In mid-July, Google detects the compromise and suspends the ads: 17 days without advertising, at the peak of the season.
The team that went on to found Cerbexia takes over the investigation. Within four days, it finds two injections nobody had detected: a script hidden in the theme template, loaded on the cart page, and a second piece of code buried in a configuration file, present since the first day of the attack, which redirected Android visitors to a fake app store. It then identifies the entry point and closes it.
Result: the site cleaned end to end, Google restrictions lifted, and file integrity monitoring in place ever since. This is the method we apply on every engagement.
Standards-based incident response, not improvisation
Every engagement follows industry frameworks, with service commitments written into the contract.
Applied frameworks
Incident response aligned with NIST SP 800-61; audits and penetration testing per OWASP, PTES and ANSSI guidance; documented chain of custody on every engagement.
Certified engineers
Forensic analysis and offensive security delivered by certified cybersecurity engineers, supported by our AI-assisted analysis playbooks.
Contractual SLAs
First response from an engineer within 5 hours, Monday to Friday, 8am to 8pm. “Response” means talking to an engineer, not an automated acknowledgement.
E-commerce fluency
We quantify an incident in lost revenue, suspended campaigns and customer trust — not only in vulnerability identifiers.
A cyberattack is not a death sentence — it is a matter of preparation and speed
You will often read that 60% of attacked companies go out of business within six months. That statistic has never been substantiated: of 170 French companies hit by ransomware, seven ceased trading, and three were already in financial difficulty. We prefer verifiable figures — they all point the same way: preparation and response time are what make the difference.
of ransomware-hit companies resumed operations within 7 days when their backups were properly configured.
of companies that recovered quickly had functional, tested backups. Without them, downtime is measured in weeks.
of reported business email compromises involved accounts without multi-factor authentication.
average cost of a cyber incident for an SME: lost trading, remediation, wire fraud, customer attrition.
Sources: Stoïk annual cyber claims report (5,000 European policyholders); Breizh Cyber study of French companies hit by ransomware. We cite our sources — a provider selling fear with unverifiable numbers should be a red flag.
Four phases, monitoring included
Triage
Confirmed compromise or false positive? Scope, exposed data, legal obligations. Engagement authorisation signed online, secure access established.
Analyse
Server logs, file integrity, persistence mechanisms, timestamps, accounts and third-party access. The goal is the entry vector, not just the symptoms.
Eradicate
Cleanup, full credential rotation, critical file locking, server and WAF hardening, verification re-scan before closure.
Monitor
Integrity probes and automated watch for 30 days, with an alert channel validated by a real end-to-end test.
Unsure about your store?
The price is public and fixed: €990 excl. VAT if your store is not hacked, €1,990 excl. VAT if it already is.
Contact usCleaning is not enough. We stay by your side.
30 days of monitoring
After every engagement, your site stays under integrity monitoring. Any suspicious change triggers an alert and a call.
A written good-practice plan
For you and your team: access, updates, backups, modules, providers. What to do, in which order, in plain language.
An engineer you can reach
The same contact, by phone, for your questions in the weeks that follow. No ticket, no queue.
Contact us
An engineer replies within 4 to 5 hours — within 4 hours for continuous-protection subscribers.
[email protected]
Remote engagements across Europe — EN / FR / ES / IT / PT / PL / HU / CS