IT se­cur­ity in­cid­ent - What to do?

What do I do as an end user in an IT emergency?

Step by step

  1. stay calm, do not take any ill-considered measures
  2. disconnect device from WiFi/network (pull network cable)
  3. record what is happening (photo, video, etc.)
  4. leave everything as it is. Also do not remove unpleasant files!
  5. do NOT turn off or disconnect device from power:
    → Important tracking data could be lost
    1. Only switch off with current backup
      (pull cable, press on on button for a long time)
  6. briefly note own assessment of incident and amount of damage
  7. report incident by using the report form on the right and inform possible affected parties


  • Do not pass on any information to third parties
  • Under no circumstances pay extortion money
  • Do not try to fix the problem yourself
Relevant Documents

Reporting an Information Security Incident:

Word: Incident Report.docx
OpenOffice: Incident Report.odt

PDF: Incident Report.pdf

Reporting a loss of data media:

PDF: Supplementary questions for reporting a loss of data media.pdf

Phishing attack: What to do?
Further Information

Check out our new F.A.Q. and learn more about IT security!