Incident help

Incident help

Suspect a security incident?

We will contact you within 60 minutes of receiving your report to make an initial assessment and agree the next steps. Briefly describe the situation and give a safe phone number.

Contact channels

First contact
within 60 minutes of receiving your report
Report an incident

Report

Report an incident

A few details are enough for us to get in touch — within 60 minutes of receiving your report.

What you noticed and when, which systems or data may be affected, what has been done so far.

Don’t enter passwords, access keys or login details. Don’t send logs or files — we will agree a separate channel for exchanging material.

We will use the data from your report to contact you about the incident. Privacy policy

or write directly: hello@dc9.io

What happens next

  1. We talk about the situation

    We contact the person named in your message to understand what happened and what is at risk.

  2. We agree the scope of help

    We establish what information and access are needed and how to share them securely. If needed, we start with a non-disclosure agreement (NDA).

  3. We work alongside your team

    We analyse traces, help limit the impact and plan the return to safe operation.

Before we get in touch

  • Isolate suspicious devices from the network (cable, Wi-Fi, VPN). Do not switch them off unnecessarily — memory may hold traces. If disconnecting is not possible and the attack is spreading, power the device down.
  • Write down what was done and when. Such notes make later findings much easier.
  • Discuss the incident over a channel that could not have been compromised — for example by phone rather than company email.

Common situations

Questions about incident help

Should I switch off infected computers?

First isolate them from the network — this stops the attack from spreading and preserves traces in memory. Power a device down if disconnecting it is not possible and the attack is spreading. This follows guidance such as CISA’s.

Do I have to report the incident to a regulator?

If you establish a personal data breach, the GDPR requires notifying the data protection authority within 72 hours, unless the breach is unlikely to pose a risk to people. Incomplete findings should not delay the notification — information can be provided in phases. Entities covered by NIS2 and the financial sector (DORA) have separate obligations and deadlines. We help you work out what applies to you.

Do you work remotely?

Most of our work is done remotely, which shortens response time. On-site work is agreed depending on the situation.

What about evidence?

Do not send it in your first message. After the first contact we agree a secure channel for logs, disk images and other material.

Want to prepare your organisation before something happens?

Tabletop exercises, penetration tests and audits let you check how ready your team and systems are, in calm conditions.

See our services