Report a security incident

Before you do anything else

• Do not turn affected machines off. Disconnect them from the network instead, so evidence in memory is preserved.
• Do not delete suspicious messages, mailbox rules or files. They are evidence.
• If money has been sent to a changed account, contact your bank straight away; speed matters more than certainty here.
• Tell your insurer early. Many cyber policies require prompt notification and may specify who is allowed to carry out the response.
• Write down what happened and when, as it happens. Reconstructing the timeline later is much harder than it sounds.