Short answer
Stay calm and act in an orderly way: document the incident, disconnect affected systems from the network rather than wiping them, bring in professional IT or incident response help and – if you have a policy – inform your insurer early. At the same time, check your legal reporting duties.
Step by step
- 01
Identify and document the incident
Note the time, what you observed, which systems are affected and what you have already done. These notes help service providers, authorities and your insurer.
- 02
Limit the spread
Disconnect affected devices from the network without hastily rebuilding them or deleting data. Evidence may matter for analysis and claims.
- 03
Get expert help
Bring in your IT provider or an incident response team. The BSI publishes lists of qualified service providers.
- 04
Inform your insurer
If you have cyber insurance, report the incident early and agree costly steps in advance. Many policies offer an emergency hotline.
- 05
Secure access
Change credentials from an unaffected device – starting with administrator, email and banking access.
- 06
Check reporting duties
If personal data is affected, notifying the data protection authority within 72 hours may be required (Art. 33 GDPR).
- 07
Manage communication
Decide who informs staff and customers. Communicate factually and without speculation.
Checklist
- Emergency contacts (IT, insurer, bank) at hand – offline too
- Person responsible for decisions named
- Procedure for disconnecting systems known
- Offline or separated backups available
- Incident log template available
- GDPR reporting route clarified
Common mistakes
- Rebuilding systems immediately and destroying traces.
- Hiring expensive service providers without agreeing it with the insurer.
- Communicating via a possibly compromised email account.
- Paying a ransom without expert and legal advice.
Frequently asked questions
Should we switch off all devices immediately?
Not as a blanket rule. Disconnecting from the network is usually better because volatile traces are preserved. Agree the specific approach with experts.
When do we have to inform the data protection authority?
If a personal data breach is likely to pose a risk to the people affected, generally within 72 hours of becoming aware of it.
Who can help if we don't have an IT provider?
The BSI and the Alliance for Cyber Security provide information and lists of qualified providers. The police cybercrime contact points (ZAC) are also a point of contact.
Does a newly taken out policy cover the ongoing attack?
No. Losses that have already occurred are not covered by a new policy.
Should we report it to the police?
Yes, reporting is generally advisable. The cybercrime contact points of the German state criminal police offices (ZAC) advise businesses on this.
Sources
- Federal Office for Information Security (BSI)
- Alliance for Cyber Security (BSI)
- German police crime prevention – polizei-beratung.de
Checked on 6 Oct 2026.