Emergency
Under attack right now?
Stay calm and work through these steps in order. They protect evidence, your insurance cover and your reporting deadlines.
Call your cyber insurer’s emergency line first
If you have cyber insurance, its crisis line is usually the first call. Many policies expect it before outside help is brought in.
Disconnect affected systems from the network
Unplug the network cable or turn off Wi-Fi, but don’t switch the systems off: their memory can hold evidence of the attack.
Write down what you see
Times, error messages, ransom notes, unusual accounts or emails. Keep logs and screenshots and delete nothing.
Don’t contact the attackers or pay
Take advice before any contact or payment. Countermeasures should be agreed with whoever leads the response.
Report the incident
NIS2 entities must send the BSI an early warning without undue delay, at the latest within 24 hours of becoming aware of a significant incident. Report the crime to the police: every federal state has a Central Contact Point for Cybercrime (ZAC) for companies.
Reach Zero Data
Retainer clients: call the hotline number in your retainer.
Hotline and triage are for retainer clients, with response times agreed in writing.
Not a client yet? Email us and put “Incident” in the subject line. info@zero-data.de