How To Report A Security Incident, And Why Speed Beats Certainty
You do not need to be sure. You need to be quick.
In short: report a security incident the moment you suspect one rather than when you are certain. Call 678-374-4352, option 1, do not delete anything, and stop using the account. A security incident is decided in the first hour.
The most damaging thing in most security incidents is not the attacker, it is the hour somebody spends deciding whether to report it.
You are not expected to diagnose anything. Report a security incident the moment something looks wrong and let somebody else decide what it was. People underreport because they wait for certainty, but an incident is anything that might be a breach, not only a confirmed one.
Anything involving a password: one entered on a page that turned out to be wrong, one shared, one that suddenly stopped working, or a multi-factor prompt you approved but did not trigger.
Anything involving money moving, or nearly moving, on the strength of an email, including a supplier who suddenly changes their bank details.
Anything unexpected on a screen: a ransom message, files renamed, software you did not install, a sign-in alert from a place you have never been. A missing device counts too, and so does a caller claiming to be from IT who asks you for something.
And anything you cannot explain. That category catches more real incidents than the others combined, and nobody here has ever been in trouble for reporting something that turned out to be fine.
How To Report It
Call 678-374-4352, choose option 1 and use the word security in the first sentence. That routes it differently from an ordinary fault, day or night.
Do not email it. If a mailbox is the thing that is compromised, an email report goes to the attacker as well.
Do not clean up first. Deleting the message, emptying the trash or reimaging the laptop destroys the evidence that tells us how far it went.
What Happens Next
Containment first: the account is locked, sessions are cut, the device is isolated. This is deliberately blunt and sometimes inconvenient.
Then scope: what was accessed, what was sent, what else shares that password, and whether any data left. That answer decides whether you owe notice to clients or a regulator, so it is built from logs rather than assumption, which is why preserving evidence matters.
Then recovery: clean credentials, removal of anything the attacker left behind such as mail forwarding rules, and restores from backup if files were affected. You then get a brief written record of what happened and what changed, and the control that would have prevented it gets fixed. If your insurer needs to be told, we help you tell them properly, because how it is reported affects the claim.
Would You Spot These As Incidents?
Would you report a USB stick found in the parking lot, a caller claiming to be from Microsoft who wants remote access, or a file share link from a colleague that you were not expecting?
Each of those is a security incident worth reporting, even though none involves a ransom note or a frozen screen. Attacks often begin quietly, which is why the small signs are the ones worth learning.
Reporting Mistakes That Let An Incident Grow
Telling a manager and leaving it with them. A security incident that passes through two inboxes and a meeting before anyone calls can lose an afternoon, and the person who saw it first holds the details. Tell your manager, but make the call yourself.
Clicking the link again to check whether it was real. Opening it a second time can repeat the damage, sometimes from a different device. Describe what you saw instead.
Leaving out details that seem unrelated, such as using the same password on a personal account. If that password works elsewhere, an attacker will try it there too, and the response can only cover what is known.
Deciding it is over because everything looks normal again. Intruders usually try to stay quiet, so a screen that returned to normal says little about what happened behind it.
Less Obvious Reasons To Call The Security Line
Someone outside the business is often first to notice, so call 678-374-4352, option 1, if a client or supplier mentions an odd message from you that you never sent.
Replies that never arrive, sent items that vanish, or a phone that suddenly loses all signal after a text about a SIM change all deserve a call too. They can point to hidden mail rules or a hijacked phone number used to take over accounts.
Any of these counts as a security incident at any hour, and the line is answered 24/7. There is no need to wait for the help desk to open.
What Counts As A Security Incident
Why Speed Matters More Than Accuracy
Every hour between a compromise and a response widens what an attacker can reach, and the early hours matter disproportionately.
A stolen password can be used to read email, set a forwarding rule, and study how your business approves payments, all before anyone notices. A ransomware infection spreads across shares while people are asleep. A compromised account sends convincing messages to your clients under your name.
Reporting quickly with incomplete information beats reporting slowly with a full account. We would far rather have a phone call that says I think I did something stupid and I am not sure what happened than a carefully written email two hours later.
This is also why we ask you to call rather than email a security incident. Email queues. Phones do not.
Do Not Clean It Up First
The instinct is to tidy. Delete the email, empty the trash, run a scan, and then report a clean situation. Please do not.
The email headers tell us where it came from and whether anyone else received it. The sign-in logs tell us what was accessed and from where. Deleting things removes the evidence that tells us how far it went, and it is often the only way to know whether other people were targeted too.
Do stop using the account or the device. Do disconnect a machine from the network if we ask you to. Do not delete, do not forward the message onward as a warning, and do not reply to it.
Changing your password is fine and usually helpful, but tell us you did it and when, because it changes how the logs read.
Related Guides And What To Have Ready
Closely related: what to do if you clicked a phishing link, a stolen work laptop, and spotting a fake invoice. More in Security and phishing.
When you report a security incident, have four things: what happened in your own words, the exact time, what you clicked or entered or approved, and which device and account were involved.
Call 678-374-4352, option 1. Any hour. Do not email this one and do not wait until morning.
For the wider framework behind how incidents are handled, see CISA cyber threats and advisories.
A Security Incident Checklist
Keep this somewhere you can read it without the device that might be compromised.
- Call 678-374-4352, option 1. Do not email a security incident.
- Stop using the account or the device immediately.
- Do not delete the email, the message or the file.
- Do not reply to it or forward it as a warning.
- Say what you clicked, typed or approved, plainly.
- Give the exact time it happened.
- Say which device and which account were involved.
- Say whether anyone else received the same thing.
- If you changed a password already, tell us and when.
- Stay reachable while we contain it.
Reporting a security incident quickly with half the facts beats reporting slowly with all of them.
What A Security Incident Means In Your Industry
Containment is the same everywhere. The consequences are not.
Law firms. A compromised mailbox at a firm is a confidentiality event, not just an IT one. Whether a security incident is reportable depends on what the account could reach, which is why we work from logs rather than assumptions.
Distribution and logistics. The usual outcome is fraud rather than data loss. An attacker in a distributor mailbox is generally studying how payments get approved so they can send a convincing invoice later.
Manufacturing. Ransomware is the scenario that matters most, because encrypted files can idle production. The value of a security incident report in the first hour is that it may stop the spread before it reaches shared systems.
Any hour, any day. Call 678-374-4352.
Questions About Reporting A Security Incident
That is a good outcome. Nobody is annoyed by a false alarm.
No. A fast report is what keeps an incident contained, so calling us is right.
No. Leave everything exactly as it is.
Same number, option 1 for security. It is answered around the clock.