1
First Contact
Immediate assessment and first measures on the phone.
// 24/7 INCIDENT HOTLINE
Active Security Incident?
If you are under attack right now or suspect a cyber attack, every minute counts. Our response team supports you immediately — confidentially, in a structured way and thought through from the attacker’s perspective.
Important: Do not shut down affected systems in an uncoordinated way and do not restart them — this can destroy volatile traces. If necessary, only disconnect systems from the network without switching them off.
// IMMEDIATE MEASURES
What to do right now
Do now
- Stay calm and contact us immediately
- Isolate affected systems from the network (do not switch off)
- Preserve evidence: logs, messages, screenshots
- Document the incident internally (timestamps, observations)
- Communicate via a secure, separate channel
Avoid
- Shutting down or restarting systems
- Paying ransom on your own or negotiating with attackers
- Your own „repair attempts“ that overwrite traces
- Internal communication via possibly compromised channels
- Premature public statements without a reliable picture
// PROCESS
What happens after your call
2
Triage
Severity, affected systems and scope — captured in a structured way.
3
Containment
Isolation, evidence preservation and stopping the spread.
4
Recovery
Safe recovery, hardening and structured review.
EVERY MINUTE COUNTS
Are you under attack right now?
Our response team is available around the clock. Call us — we’ll guide you through the first steps immediately.