Incident response
An account is gone, a device is compromised, or a demand has arrived.
Edgemont Advisory responds to active security incidents affecting athletes, creators, influencers, and their families. Intake is 24/7. Containment begins in the first day, evidence is preserved before platforms age it out, and you receive a written finding within a week. Engagements are usually scoped with the agent, manager, or business manager who holds the relationship.
Before we speak
Stop using the compromised account or device
Including for password resets. A reset performed from a compromised device hands the attacker the new credential as well.
Do not delete anything
Messages, emails, login alerts, and notifications are the evidence of how access was gained. Deleting them destroys the record of the entry point.
Do not pay or negotiate yet
Not until someone has established what the other side actually holds. It is very often less than claimed.
Do not post about it
Public attention raises the value of the attack and attracts copycats. It also tips off the person still inside the account.
Screenshots are useful. Take them before anything is cleaned up.
What counts as an incident
An account locked, hijacked, or posting content the owner did not post.
An extortion, blackmail, or leak threat.
A phone or laptop lost, stolen, or handled by someone untrusted.
Personal information published — address, family, school, routine.
Impersonation accounts contacting fans, sponsors, or family.
A payment or wire request that looks wrong, or has already gone out.
Login alerts, unfamiliar sessions, or password resets nobody requested.
If a wire has already left, say so first. That is the most time-critical situation we handle, and the window for recovery is measured in hours rather than days.
How the response runs
Respond
Hours 0–24. Containment first: accounts locked and recovered, active sessions killed, credentials rotated, evidence preserved before the platforms age it out. Login history and device records have short retention windows and are routinely lost because nobody captured them in time.
Determine
How access was gained, what was reached, what was taken, and whether they are still there. This is the technical core of the engagement, and it is what makes remediation specific rather than generic.
Remediate
Close the specific door that was used — not a checklist — then keep watching it. Scoped by what the investigation actually found.
The engagement closes with a written incident and recovery brief: what happened, what was done, what remains open, and what we recommend. Every assertion is tied to a named source a third party could verify independently, and open questions are stated rather than smoothed over.
Common questions
Do you need our passwords?
No. Discovery and triage require no credentials — triage is you describing what happened, plus screenshots. Where account access is genuinely required, it is handled live on a Teams or Zoom call with you driving your own screen while we walk you through it. Credentials are never collected by email or by form.
Should we call the FBI or the police?
Usually yes, but in parallel with the response rather than instead of it. Fraud and extortion go to ic3.gov, and for a wire already sent this is genuinely time-critical. Anything with a physical safety dimension goes to local police as well, since a case number often unlocks faster platform escalation. For a public figure, a police report can become a discoverable record, so where and how to file is worth a conversation with counsel first.
How fast can you start?
Intake is 24/7 and triage begins immediately. Resolution timelines depend on the incident and the platforms involved, so those are not promised in advance. The commitment is that the first response is immediate.
What does incident response cost?
Emergency response is a single fixed fee covering intake and containment, investigation, and the findings briefing — scoped as one engagement rather than an open hourly clock. Remediation is priced as a project against what the investigation found. There is no charge for the initial call to establish whether an engagement makes sense.
Does this create an eligibility problem for a college athlete?
Engagements are structured so that it does not. Services are billed at standard rates with no comping or discounting, fees are paid by the athlete or their representation, and promotion is never accepted in place of payment. Written scope and terms are provided to the institution's compliance office on request before work begins.
Report an incident.
Tell us how to reach you and we will respond directly. Do not include account credentials, explicit material, or the specifics of an extortion demand — contact details only. We move to a secure channel on the first call.