Cyber incident response · Medical & dental practices
Hacked? We handle it from the first call.
No contract, no setup. We walk you through it in plain English.
Call or text, 24/7. A responder is on the phone within 20 minutes. The first call carries no charge and creates no engagement. We never ask for your password or remote access.
- On the phone within 20 min · 24/7
- First call: no charge, no engagement
- We never ask for your password or remote access
Systems we work in every day
Google Workspace
Microsoft 365
Gmail
Outlook
iCloud
Windows
Mac & iPhone
Android
Weave
RingCentral
WordPress
GoDaddy
Squarespace
QuickBooks
Dentrix
athenahealth
Eaglesoft
eClinicalWorks
Open Dental
NextGen
Curve Dental
Tebra
Denticon
ModMed
DrChrono
Practice FusionWhat's happening?
Something's wrong
Weird emails sent from you
- Leave the sent messages in place
- Warn recipients by phone, not email
- Do not reply from the account
Still sending after a password change
- A reset does not end active sessions
- Hidden rules and forwarding remain
- Leave everything as is; we check each
Locked out of an account
- Do not create a replacement account
- Note when access was lost
- Have any recovery codes ready
Files locked or ransom note
- Disconnect the network cable and Wi-Fi
- Do not power off, restart or wipe
- Do not contact the attacker or pay
Payment sent to a scammer
- Call your bank's fraud line now; request a recall
- File a report at ic3.gov
- Keep every related email and invoice
Lost laptop or phone
- Note the last known time and place
- Do not wait for it to turn up
- We sign it out of every account remotely
Not sure
Sign-in alert from another country
- Do not click links in the alert
- Note the time and location shown
- Text us a screenshot; crop out patient names
Someone clicked a link
- Note whether a password was entered
- Do not delete the email
- Anyone on staff may call.
A patient asked, "Did you email me?"
- Ask them not to open links or attachments
- Ask them for a screenshot
- Leave your sent folder untouched
A vendor sent a breach letter
- Keep the letter
- Note which data it lists
- We assess your exposure and next steps
Your IT provider says it is fine
- Ask what was checked
- Text us what concerned you
- We provide an independent second opinion
We're here to help.
No judgment. No pressure.
- US-based
- DE-registered
- Medical & dental
- Works with your IT provider
How it works
Enterprise-grade response, sized for your practice.
- Now
Triage
- Incident scope identified
- Affected accounts and devices
- Financial and patient-data exposure
- Within 20 min · 24/7
Containment
- Rapid threat assessment
- Unauthorized access revoked
- Further spread prevented
- Same day
Investigation
- Sign-in and activity logs analyzed
- All accounts and devices reviewed
- Entry point and impact determined
- After
Recovery & reporting
- Insurance claim support
- Regulatory guidance, with your counsel
- Formal incident report
Minimal disruptionYou return to patient care while we manage remediation.
Why practices trust Kemrin
Founder-led. Registered in Delaware. Open to verify.
Speed
Containment begins on the first call, day or night.
Precision
AI-assisted log analysis, reviewed by a senior responder. Every account and device checked.
Discretion
BAA signed before access. Patient data stays out of our notes. Findings go only to you.
Questions
Serious enough to call?
If you are unsure, call. The first call determines it, at no charge.
Changed the password, still happening?
A new password does not end active sessions or remove forwarding, filters, delegates, recovery details or connected apps. We check each.
Do we need to know if we use Google or Microsoft?
No. We identify it on the first call.
What should we have ready?
Nothing is required. Administrator access helps; we can begin without it.
How are patients kept informed?
We assess what was affected and help you prepare any patient communication.
Who handles our call?
A senior responder handles every call. AI assists with log analysis; patient details are excluded.
How soon should we call?
As soon as you notice something. The first call carries no charge.
Will you sign a BAA?
Yes. We sign a business associate agreement before accessing any account that holds patient data.
Not sure whether to file a claim?
We document the scope and likely cost first, so you and your broker can decide. Our first call creates no engagement.
What does it cost?
First call: no charge, no engagement. Email takeover: $1,000 flat, covering up to 4 hours. Any further work is quoted in writing first. Card or invoice.