Incident help

Data breach

Suspect a data breach? Limit the damage and establish your reporting obligations

DC9 Cyber helps limit the damage of a breach, establish its scope and your reporting obligations. We contact you within 60 minutes of receiving your report.

Contact channels

First contact
within 60 minutes of receiving your report
Report an incident

First steps

  1. Limit the damage: change passwords and revoke keys for systems that may be affected, block suspicious accounts.
  2. Do not delete logs or accounts that may have been used — they are needed for the investigation.
  3. Note when and how you became aware of the event.
  4. Establish whether a personal data breach has occurred. From that moment you have 72 hours to notify the data protection authority — incomplete findings should not delay it; information can be provided in phases.
  5. Name one person responsible for decisions and communication.

When to suspect a breach

  • company or customer data has appeared online or on a criminal forum
  • someone reports receiving your data or documents
  • you see unusual data transfers to the outside
  • criminals demand money not to publish data

Report

Report an incident

A few details are enough for us to get in touch — within 60 minutes of receiving your report.

What you noticed and when, which systems or data may be affected, what has been done so far.

Don’t enter passwords, access keys or login details. Don’t send logs or files — we will agree a separate channel for exchanging material.

We will use the data from your report to contact you about the incident. Privacy policy

or write directly: hello@dc9.io

How we help

  • we analyse logs and systems to establish the scope and source of the breach
  • we check whether the attacker still has access
  • we assess which people and data are affected
  • we help prepare the regulator notification and communication to affected people
  • we recommend changes that close the leak path

Frequently asked questions

What is the difference between a suspected incident and a personal data breach?

A suspicion is a signal that needs checking. A personal data breach is established when you are reasonably certain that data has been disclosed, lost or altered. The 72-hour notification deadline runs from that moment.

Do I need to know the full scope before notifying the authority?

No. The GDPR allows information to be provided in phases when it cannot all be gathered at once. Notify on time with what you know and update it as findings progress.

Does every breach have to be reported?

A personal data breach is reported unless it is unlikely to pose a risk to people. The assessment should be documented — we help prepare it. Entities covered by NIS2 or DORA may have additional obligations.

Common situations