Skip to content
Cyberschutz.io

Act in an incident

During an ongoing incident, a measured, coordinated response matters. Bring in professional IT or incident response help. New insurance does not cover losses that have already occurred.

Incident sequence

Eleven steps sorted by priority. In an emergency: act calmly, in coordination and keep records.

Now

  1. Scope the incident

    What is affected – one device, an account, a server, the shop? Since when? Note first observations with times.

  2. Do not wipe or reset systems hastily

    Reinstalling destroys traces that matter for analysis, insurers and authorities. Preserve first, then clean.

    Important

  3. Secure access

    From a clean device, change passwords of affected and privileged accounts, end sessions, check MFA.

  4. Isolate affected systems

    Disconnect from the network, but don't switch devices off if a provider still needs to analyse them.

Next

  1. Secure evidence and logs

    Keep logs, emails, ransom notes and screenshots; continue the timeline.

  2. Activate IT staff and providers

    Bring in your internal IT lead and external provider or incident response team.

  3. Clarify incident roles

    One person coordinates. Who decides, who documents, who communicates?

  4. Check backup and restore

    Are backups intact and separate? Restore only once the cause is understood – otherwise reinfection is likely.

After that

  1. Check legal and data-protection reporting duties

    Whether you must notify the data protection authority or others depends on the case. If a GDPR notification duty applies, the deadline is generally 72 hours from awareness. Seek professional advice if unsure.

    Important

  2. Inform customers and partners only in coordination

    Agreed, factual communication through a defined channel – no premature statements on cause or scope.

  3. Involve your insurer early

    With existing cyber insurance, contact the claims hotline early; many policies provide service providers and procedures.

In detail in our guide: A cyber incident: first steps for your business

This information does not replace individual legal or data-protection advice. Insurance taken out now does not cover losses that have already occurred.

Typical cases in a business

Ransomware or encrypted data

  1. 1Disconnect affected systems, do not reinstall
  2. 2Bring in your IT provider or incident response team
  3. 3Inform your insurer and follow its instructions
In detail in our guide: Preparing backups against ransomware

Compromised email account

  1. 1Change the password and end all sessions
  2. 2Check forwarding and inbox rules
  3. 3Warn customers and partners in coordination if messages were sent

Payment fraud / CEO fraud

  1. 1Contact the bank immediately and request a recall
  2. 2Keep records; a police report usually makes sense
  3. 3Introduce approvals with call-back via a known number
In detail in our guide: Preventing invoice fraud and CEO fraud

Possible data breach

  1. 1Establish and document the scope of affected data
  2. 2Check whether a reporting duty applies – not every incident must be reported
  3. 3Inform affected people where required

Read next: Guides

All guides