Emergency
Is your company under a cyberattack?What to do now
Stay calm and act in this order: isolate the affected devices without switching them off, preserve the evidence, change passwords from a clean device and get specialist help. Write to us or call us and we will guide you through the first steps.
The first hour, step by step
- 01
Isolate without switching off
Disconnect the affected devices from the network (cable and Wi-Fi). Do not switch them off: memory holds evidence that would be lost.
- 02
Do not delete or reinstall anything
Keep logs, suspicious emails and ransom notes. Take photos of what you see on screen.
- 03
Change passwords from a clean device
Start with email, administrators and banking, and turn on two-step verification.
- 04
Tell your insurer
If you have a cyber policy, report it as soon as possible: it is often a condition of cover.
- 05
Do not pay or negotiate without advice
Paying does not guarantee getting anything back and may have legal implications.
- 06
Get specialist help
A response team contains the attack, recovers the systems and prepares the information for notifications.
Who to notify and by when
Depending on the company and what happened, there may be notification duties. These are the main ones:
| Who | When | Basis |
|---|---|---|
| The data protection authority (AEPD in Spain), if personal data is affected | Within 72 hours of becoming aware of the breach | GDPR, art. 33 |
| INCIBE-CERT (companies) or CCN-CERT (public sector) in Spain | Depending on the applicable regime | Royal Decree-law 12/2018 |
| Entities subject to NIS2 | Early warning within 24 h, notification within 72 h and a final report within one month | NIS2 Directive, art. 23 |
| In Portugal: CNCS | Deadlines of the national regime | Decree-Law 125/2025 |
| The police | Criminal complaint | — |
| Your cyber insurer | As per the policy | Contract |
An indicative summary, not legal advice: each case is reviewed with the company’s legal adviser or DPO.
Public resources that can help
- Spain: INCIBE’s 017 cybersecurity helpline, free and confidential, for businesses and citizens.
- Spain: INCIBE-CERT for companies and CCN-CERT for the public sector.
- Portugal: CNCS / CERT.PT.
Frequently asked questions in an emergency
No. Disconnect them from the network but do not switch them off: memory holds useful information about what happened.
Not without advice. Paying does not guarantee getting the data back or that it will not be published, and may have legal implications.
Filing a police report is advisable and, if personal data is affected, consider notifying the data protection authority within 72 hours.
We can help now
Write to us with what you are seeing: which devices are affected and what happened.