Should we report a cyberattack to the police?
Yes, in most cases. Ransomware, extortion, fraud and data theft are crimes, and a police report helps investigators link cases, sometimes leads to decryption keys from law-enforcement operations, and is often required by insurers for a claim. Reporting to the police is separate from any regulatory notification to your CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported. or data protection authority; you may need to do several. Many countries have specialised cybercrime units or online reporting for businesses, and your national CSIRT can tell you where to go. Bring the facts: the timeline, the ransom note and messages, payment demands, indicators such as IP addresses and domains, and the costs so far. Reporting does not mean losing control of your recovery, and it does not usually make the incident public. NetSenX alerts, with times, hosts and destinations, can be part of what you hand over.
Read next
Related questions
- Could an insider stealing money with malicious code have been spotted?
- Was our website outage a cyber attack? How do we find out?
- Does network detection stop DDoS attacks, and how does it differ from DDoS protection?
- What does NetSenX give us during an incident?
- A supplier with access to our systems has been hacked. What do we do?
Terms used here
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.