Job 2 — A Real Search Engine for Your Readers
Everything below is follow-up breach-response work — each tier includes the one below it, and prices are not-to-exceed ceilings. We recommend T2 (Scope) — it's the tier that answers the Florida FIPA legal question. Is T2 optional? Is it your lawyer's call? The security FIXES are simple "close this door or not" calls — ours to recommend, yours to approve. T2 is different: it is not a fix, it answers a LEGAL question. Under Florida's data-breach law (FIPA — the Florida Information Protection Act), when personal information is exposed, a business can be legally required to notify the affected people (and, above a threshold, the state) within a set number of days of determining a breach occurred. What T2 produces: the determination of whose data was in the exposed database, and therefore who — if anyone — must be notified. Whether you are legally obligated to notify is a determination your lawyer should make, not us — we are not your attorney. What we can tell you plainly, so your lawyer has the facts: FIPA's clock starts on the date a breach is determined — for you that's July 15 — and personal data was in the exposed database and it was downloaded. Those two facts are exactly the trigger FIPA is written around. We strongly recommend putting this in front of your lawyer now and letting them confirm whether notification applies. An earlier internal note of ours called T2 "not optional" — that overstated our authority. The accurate statement: T2 is the work that answers your lawyer's question. We won't push the urgency past what's actually true.
- $950 NTE ceiling.
- Reset all 10 named admin passwords.
- Rotate credentials for SMTP / mailing list / third-party integrations.
- Set / rotate the backup-encryption passphrase.
- Deliver a written containment completion report.
- 🎯 RECOMMENDED — this is the work that answers the FIPA legal question below.
- $2,450 NTE ceiling. Includes everything in T1.
- Determine exactly whose personal data was inside the exposed database.
- Produce the affected-party report — the list of who, if anyone, is notifiable.
- Attribute the access — tie the downloads to the exposed sources.
- Full persistence audit — confirm the attacker left nothing behind (backdoors, rogue admins, scheduled tasks).
- $3,950 flat · includes everything in T1 + T2.
- Stand up a client-owned, off-site backup destination (you own it, not a prior vendor).
- Run a verified restore test — prove the backups actually restore.
- Remediate backup retention.
- Add external uptime + security monitoring.
- Reroute WordPress notifications to an address you control.
FIPA notification clock
Florida's FIPA notification timeline runs from the date a breach is determined — July 15, 2026 for this incident. T2 is the minimum that tells you whether and whom you must notify. This is your lawyer's call; we're flagging the clock so they have the facts.