Immediate actions¶
Decisions made in the first hour after an incident are usually made under stress, and stress reliably degrades decision quality. This list exists so those decisions can be made now, in advance, rather than during the event.
The instinct in the first hours is often to understand what happened before doing anything. This is usually wrong. Accounts can be emptied and identity documents used while you are still investigating. Act first; understand later.
Disconnect all devices from the network (unplug the router if needed).
Call banks using numbers from the back of the card, not from any email or message received. Request fraud alerts. Replace compromised cards.
Report identity theft if personal identity documents were exposed.
Where to report¶
North America¶
United States: Federal Trade Commission (FTC), 1-877-ID-THEFT (1-877-438-4338). Also file a police report with local law enforcement.
Canada: Canadian Anti-Fraud Centre, 1-888-495-8501. Contact local police and credit bureaus (Equifax, TransUnion).
Europe¶
European Union: Europol’s European Cybercrime Centre (EC3). Also report to local police and national cybercrime units.
United Kingdom: Action Fraud, 0300 123 2040.
Germany: Federal Office for Information Security (BSI). Local police (online reporting form available).
Asia-Pacific¶
Australia: Australian Cyber Security Centre (ACSC), 1300 292 371.
India: National Cyber Crime Reporting Portal, 1930 (Cybercrime Helpline).
Japan: National Police Agency (NPA), local police cybercrime divisions.
Latin America¶
Brazil: SaferNet, 100 (Human Rights Hotline).
Mexico: Condusef (Financial Fraud), 55-5340-0999.
Africa¶
South Africa: South African Fraud Prevention Service (SAFPS), 0860 101 248.
Nigeria: Economic and Financial Crimes Commission (EFCC), +234 9 9044752.
Middle East¶
United Arab Emirates: eCrime.ae, 901 (Dubai Police).
Saudi Arabia: National Cybersecurity Authority.
Global¶
Credit bureaus (freeze credit): Equifax, Experian, TransUnion (availability varies by country).