Encrypted Files and Ransom Notes
Files have new extensions and can no longer be opened, and a ransom demand appears on screens. This means a ransomware attack is underway – learn more about our Ransomware Response.
Incident Response & Forensics
Cyberattack – What to Do? Emergency Incident Response
Keep a cool head when every hour counts.
Hit by a cyberattack – what now? Disconnect affected systems from the network, but don’t shut them down, and get support. With our emergency incident response, we help you remotely and on-site to contain the attack, preserve evidence, restore your systems cleanly and meet your reporting obligations.
- 24/7 emergency hotline
- Remote & on-site
- Support with reporting obligations
First Steps
Cyberattack: What to Do in the First Hours?
A cyberattack rarely announces itself clearly. It’s usually noticed because the antivirus raises an alert, accounts get locked, a server sends out unusually large amounts of data or files can no longer be opened. Then the question is: What needs to be done now – and what must be avoided at all costs?
The first hours determine how big the damage will be. Shutting down affected systems prematurely, reinstalling them or logging on to compromised machines with administrator accounts destroys evidence or hands the attackers additional credentials. Hesitating too long gives them time to exfiltrate data and destroy backups.
Stay calm, isolate affected systems from the network without shutting them down, and don’t log on to them with privileged accounts – this is also what the BSI (Germany’s Federal Office for Information Security) recommends in its guidance paper “Erste Hilfe bei einem schweren IT-Sicherheitsvorfall” (first aid for serious IT security incidents). Write down your observations with the time, coordinate via independent channels such as mobile phones, and bring in external support early.
That’s exactly what our emergency incident response is for: together with you, we build a picture of the situation, stop the spread, uncover the attack path and support a clean return to operations. At the same time, we keep an eye on reporting obligations under the GDPR, NIS2 or DORA, coordination with your cyber insurer, informing employees and customers, and the question of whether to file a criminal complaint.
Our Approach
How Our Emergency Incident Response Supports You
Everything starts with your call to our IT emergency hotline or a report via the emergency form. In the first conversation, we clarify what has been observed, which systems might be affected and which processes have come to a standstill. You receive initial recommendations for action, and together we decide whether we support you remotely, on-site or both.
After that, we work on two levels. On the technical side, we contain the attack, secure volatile and persistent evidence and look for the entry point as well as further compromised systems and accounts. On the organizational side, we provide your crisis team with reliable facts for decisions about shutdowns, emergency operations, reports and communication.
We follow recognized recommendations and standards such as module DER.2.1 “Security Incident Handling” of the BSI’s IT-Grundschutz framework, ISO/IEC 27035 and NIST SP 800-61 Rev. 3. One principle applies: wherever possible, systems are only restored once the entry point and backdoors are known and closed – otherwise the attackers may soon be back in the network.
Typical Signs
How to Recognize a Cyberattack
Unknown Accounts and Sign-Ins
New administrator accounts, sign-ins at unusual times or from unfamiliar locations, and MFA prompts that nobody triggered.
Disabled Security Controls
Antivirus or EDR has been disabled, logs deleted, shadow copies removed – typical preparations before attackers strike.
Alerts from EDR, SIEM or Firewall
Alerts about tools that read passwords from memory, suspicious PowerShell commands or connections to known command-and-control servers.
Unusual Data Traffic
Large volumes of data flow to cloud storage or unknown destinations at night, and servers establish unexplained connections to the internet.
Tampered Mailboxes
Unknown forwarding rules, phishing emails sent from your own mailbox, or invoices with suddenly changed bank details.
Tips from Outside
Customers report suspicious emails in your name, credentials show up on the dark web, or your provider, the BSI or the police point out anomalies.
Engagement Options
Remote, On-Site or Both
How we support you depends on the situation. We often start remotely and come to you if needed.
No Travel Required
Remote Support
We work via secure remote access and guide your IT team or service provider.
- Analysis of logs, EDR and cloud data
- Guidance on immediate measures and containment
- Well suited for cloud services such as Microsoft 365
Germany & International
On-Site Response
When storage media need to be secured, networks physically separated or a crisis team supported, we work directly at your premises.
- Forensic acquisition of storage media and memory
- Support for your crisis team
- Help with rebuilding
Remote & On-Site
Combined Response
For larger incidents, we combine both: part of the team analyzes remotely while another part secures evidence and coordinates on-site.
- Parallel analysis and evidence preservation
- Dedicated contact person for your crisis team
- Joint situation briefings
Process
How an Emergency Engagement Works
As across our entire Incident Response & Forensics practice, we follow the proven phases of incident handling. We agree on the scope and an individual quote with you.
-
01
First Contact & Triage
You describe the situation via the emergency hotline or the emergency form. We give initial recommendations, clarify goals and the scope of the engagement, and decide whether we start remotely or on-site.
-
02
Detection & Analysis
We secure evidence and determine which systems, accounts and data are affected.
-
03
Containment
We stop the spread, close the attackers’ access and protect intact backups from further access.
-
04
Eradication
Backdoors and persistence mechanisms are removed, the entry point is closed, compromised credentials are reset and affected systems are rebuilt.
-
05
Recovery
We support the prioritized return to operations from verified backups and, together with your team, watch for signs of renewed activity.
-
06
Post-Incident Review
Final report, lessons learned and prioritized measures to keep the incident from happening again.
Final Report
From First Assessment to Final Report
During the engagement, your crisis team receives regularly updated situation reports. At the end, we document the incident in a traceable way – for senior management, IT, insurers, authorities and, if necessary, court proceedings. Findings are backed by sources and timestamps, and facts and assumptions are clearly separated.
- Executive summary with cause, impact and current status
- Timeline from initial access to containment
- Affected systems, accounts and data
- Measures taken and status of the cleanup
- Technical facts for reports and insurers
- Lessons learned and prioritized recommendations
Under Attack? Call Us Now.
You can reach us at +49 2932 465265-0 Mon–Fri, 8:00 a.m.–5:00 p.m. (CET/CEST); outside these hours, the same number is our 24/7 emergency hotline. The sooner we know the situation, the more evidence can be preserved.
FAQ
Frequently Asked Questions About IT Emergency Response
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
What should we do first after a cyberattack?
Stay calm and disconnect affected systems from the network – unplug the cable, disconnect the Wi-Fi – but don’t shut them down: memory holds volatile evidence such as running processes and network connections that would otherwise be lost. Only if encryption is actively running and a system can’t be isolated may shutting it down be the lesser evil. Don’t log on to suspicious systems with administrator accounts, don’t delete anything, write down observations with the time and call our emergency hotline – by mobile phone if necessary, in case your phone system or email is affected.
Do we have to report the incident?
That depends on the incident and on your organization. If personal data is affected, the data protection supervisory authority generally has to be informed under Art. 33 GDPR without undue delay and, where feasible, within 72 hours of becoming aware of the breach; if the risk is high, the affected individuals must also be notified under Art. 34 GDPR. Entities covered by NIS2 – including operators of critical facilities – report significant incidents to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance): an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that notification. Financial entities report major ICT-related incidents to their supervisory authority under DORA. We provide the technical facts – you make the legal assessment together with your data protection and legal advisors.
Should we involve the police?
We recommend it, as do the BSI and the police. For businesses, the State Criminal Police Offices (LKA) and the Federal Criminal Police Office (BKA) have set up Central Contact Points for Cybercrime (ZAC), which advise affected organizations and help with filing a criminal complaint. It’s important that evidence is properly secured and documented. If you wish, we prepare our findings for handover to the investigating authorities.
Do you work with our IT service provider and our cyber insurer?
Yes. Your IT service provider knows your environment best – we work closely with them and add forensic expertise. Inform your cyber insurer early, as many policies contain requirements for handling a claim. If you wish, we coordinate directly with the insurer.
Do we need a contract with you in advance?
No. We don’t offer standby contracts (retainers) – the hotline and the emergency form are open to you even without an existing business relationship. In an emergency, we agree on the scope and an individual quote directly with you. You can prepare with an incident response plan that defines who makes decisions and whom you call.
How do we prevent the incident from happening again?
Based on the lessons learned, typical next steps are targeted Penetration Testing of the entry points that were exploited, an emergency plan with playbooks, and Crisis & Tabletop Exercises. With Forensic Readiness, you make sure all the necessary evidence is available next time.
Related pages
Report a Security Incident
Briefly describe what happened and leave a callback number. If it’s urgent, call us as well: +49 2932 465265-0 – outside business hours, this number reaches our 24/7 emergency hotline.