Security incidents
It has happened. Now what?
A data breach, ransomware, suspicious activity on the network. Call first – the initial phone consultation is free and can decide what can be saved and discovered.
The first hours are decisive
Digital traces are fragile, and the first few decisions determine what can be saved. Before you do anything, go through these two lists – and call us.
Do right away
- If it is safe to do so, isolate the affected devices from the network – cable, Wi‑Fi, VPN
- Write down the times: what happened when, and who did what
- Note which systems, accounts or data are affected and what is still available
- Protect your backups from further access or overwriting
- Use the phone or another independent channel for coordination
- Appoint one person to coordinate the incident
What to avoid
- Do not switch off or restart devices without consulting us
- Do not reinstall systems or “clean” them with antivirus software
- Do not delete suspicious files, e-mails or accounts
- Do not make uncontrolled changes to the compromised systems
- Do not handle the incident over company e-mail or chat if they may be compromised
- Do not put off dealing with the incident – logs and other traces can be overwritten or lost over time
Deadlines that may already be running
Depending on the type of organisation and incident, you may have a duty to notify, for example, NÚKIB (the Czech cybersecurity authority), the Czech Data Protection Authority (ÚOOÚ) or another regulator. Record the exact time the incident was discovered and assess your legal obligations as soon as possible.
The specific obligations depend on the nature of the incident and the organisation’s position.
How the response works
01
Triage and first instructions
We establish what is happening, how serious the situation is and what needs to be done in the first minutes.
02
Containment and evidence preservation
We help isolate the affected systems, prevent further damage and, at the same time, preserve the important digital traces.
03
Analysis and root-cause removal
We establish how the attacker got in, which systems and data they may have reached, whether they still have access and what needs to be removed or changed.
04
Recovery and conclusions
We propose a safe path back to normal operations and prepare clear conclusions together with recommendations for appropriate measures.
Frequent questions in the first hours
Should we switch off the compromised computers?
Usually not without consulting us first. If it is safe, it is better to isolate the devices from the network and leave them in the state in which the event was discovered. In some situations, however, stopping the damage immediately may take priority. Call us and we will recommend the next steps based on the situation.
Who do we have to report the incident to?
It depends on the type of organisation and incident. A notification duty may arise under the Czech Cybersecurity Act, the GDPR or other regulations. We help determine which obligations need to be addressed and what information must be preserved.
Should we pay the ransom?
The ransom decision is not just a technical question. You need to assess the availability of backups, the extent of the damage, the risk of further extortion, legal and sanctions constraints and the terms of any insurance. Before you start communicating with the attacker or make a payment, we recommend having the situation assessed professionally and legally.
What should we have ready before calling?
Basic information is enough: when you discovered the incident, what is happening, which systems may be affected and what steps have already been taken.
Do you come on site, or do you work remotely?
It depends on the type of incident. The initial triage can be handled remotely, but properly securing devices and some forensic tasks may require work on site.
Don’t wait for an incident
Incident response retainer
During an incident there is no time to sort out contracts, access or contacts. That is why it makes sense to prepare everything in advance.
Guaranteed availability
Call any time – we respond within a contractually guaranteed time. You know in advance who is on the other end of the line and how the response will proceed.
Everything signed in advance
The NDA, the contractual framework, access and contacts are agreed beforehand – no time is lost negotiating and signing during an incident.
Forensic readiness
We set up logging, retention and the preservation of important traces so that the scope and course of an incident can be established quickly.
Not sure whether this is a case for us?
Call us – the first consultation is free, confidential and comes with no obligation.