IT emergency
Report a Security Incident
Do you suspect a cyberattack or another IT security incident? Act now: call us – that’s the fastest way – or use the form to report a security incident, and we’ll call you back. Until then, the immediate steps further down this page will help you.
- 24/7 emergency hotline
- Remote & on-site
- Support with reporting obligations
Under active attack? Call us right away.
On the phone, we agree on the first steps with you directly – that’s faster than any form. Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST), this number reaches our office; outside these hours – evenings, nights, weekends, and public holidays – the same number is our 24/7 emergency hotline for IT security incidents.
Emergency form
Report a security incident using the form
Just a few details are enough: who you are, which number we can call you back on, what happened, and how severely your operations are affected. We will call you back as quickly as possible. The form does not replace a phone call – if it’s urgent, the hotline is the faster way. Alternatively, you can reach us by email at incident@rootsektor.de – ideally from a mailbox that is not affected.
Process
What happens after you report an incident
From the first conversation to the follow-up – this is how we guide you through the incident. How quickly each step follows depends on the situation and scope; we agree on every next step with you. Learn more about our approach under Incident Response & Forensics.
-
01
Callback & initial assessment
After a form submission, we call you back at the number you provided; if you call us yourself, the initial assessment begins right there on the phone. We get a picture of the situation and give you concrete guidance for the next few hours. Together we clarify whether we start remotely or support you on-site, who makes the decisions on your side, and whether reporting obligations might apply.
-
02
Containment
We help your IT team stop the spread – isolating affected systems, locking compromised accounts, closing the attackers’ access. In the process, we secure volatile evidence before it is lost.
-
03
Analysis & forensics
We analyze systems, logs, and malware and reconstruct the entry point, attack path, and affected data. The results provide the facts for your decisions, for notifications to authorities, and for coordination with your cyber insurer.
-
04
Recovery & follow-up
We support an orderly recovery from clean backups, verify that the attackers are really locked out, and document everything in a final report. In a lessons-learned session, we work out how you can prevent future attacks or detect them earlier.
FAQ
Frequently asked questions about reporting an IT emergency
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What counts as an IT emergency?
Any security incident that poses an acute threat to your data, systems, or business operations – such as encrypted files and ransom notes, unknown administrator accounts, a hijacked email account, signs of data exfiltration, alerts from your antivirus software, or unexplained system outages. When in doubt, it’s better to reach out too early than too late: a short assessment on the phone brings clarity. We describe typical scenarios under IT Emergency Response and Ransomware Response.
Does reporting an incident to Rootsektor replace a report to the authorities?
No. With the form or a phone call, you inform Rootsektor as a service provider. Statutory notifications – for example, to the data protection supervisory authority under Art. 33 GDPR, to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance) under § 32 BSIG (German BSI Act; NIS2), or to BaFin (Germany’s Federal Financial Supervisory Authority) under DORA – must be submitted by your organization itself. We support you with the technical facts and keep an eye on the deadlines together with you.
We are not a customer yet – can we still contact you?
Yes. You don’t need an existing contract; we don’t offer standby or retainer agreements anyway. Simply contact us by phone or via the form. We offer our emergency services on an individual basis – we agree on the scope and terms with you right at the start.
Do you also come to our premises?
Yes, if necessary. Many initial measures can be started remotely, such as analyzing logs or coordinating containment with your IT team. For the forensic acquisition of storage media or to support your crisis management team, we also assist you on-site – in Germany and internationally. We decide together how to proceed after the initial assessment.
What happens to the information I enter in the form?
Your report is sent to our team by email and is used solely to handle the incident. You receive a confirmation with a reference number – please have it ready if you have any questions. Please do not send passwords or login credentials through the form – we will agree on a secure way to exchange them with you by phone. You can find details in our Privacy Policy.