# How do we communicate during an incident if our e-mail may be compromised?

Move the incident discussion to a channel the attacker cannot read before you say anything about your plans. Attackers who control a mailbox or the directory often read the response team's messages and adapt. Agree in advance on an out-of-band channel: phone calls, a messaging group on devices that do not use company accounts, or a separate collaboration space with its own logins. Keep a printed contact list, because the address book may be unavailable. Ask your insurer, bank and key customers to confirm any request from you by phone, because criminals sometimes send fake messages in the middle of an incident. Once the directory and mail are rebuilt and credentials reset, move back. NetSenX alerts live in their own dashboard, which you can open from a clean device, so the network picture does not depend on company e-mail.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/how-to-communicate-when-email-may-be-compromised

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Why should we keep a written log during an incident?](https://netsenx.com/en/faq/why-keep-a-written-log-during-an-incident)
- [How do we contain an incident without destroying the evidence?](https://netsenx.com/en/faq/how-to-contain-an-incident-without-destroying-evidence)
- [Should we unplug an infected computer or switch it off?](https://netsenx.com/en/faq/should-we-unplug-or-switch-off-an-infected-computer)
- [What should we avoid doing during a cyber incident?](https://netsenx.com/en/faq/what-not-to-do-during-a-cyber-incident)
- [How do we find patient zero, the first machine the attacker compromised?](https://netsenx.com/en/faq/how-to-find-patient-zero)