Reporting an IT Security Incident

A security incident is any event that may have compromised — or appears to have compromised — the confidentiality, integrity, or availability of your company's data, accounts, or systems. Reporting an incident quickly, with as much detail as possible, allows our team to contain the situation and minimize damage.

This article explains what counts as a security incident, what evidence to capture before reporting, how to submit the incident report, and what not to do while waiting for a response.

What Counts as a Security Incident

Report a security incident any time you observe or suspect any of the following:

• Malware or ransomware — files renamed or encrypted, ransom notes, unfamiliar processes, antivirus alerts
• Data loss including fire, flood, or theft affecting company equipment or storage
• Phishing where credentials were entered or a suspicious link was clicked
• Suspicious or unauthorized account activity — MFA prompts you didn't initiate, sign-ins from unexpected locations, mail rules you didn't create, sent items you didn't send
• Lost or stolen company device — laptop, phone, tablet, USB drive, or any device with company data
• Suspected data exposure or accidental disclosure — an email or file sent to the wrong recipient, a document left publicly shared, sensitive data posted somewhere it shouldn't be
• Business email compromise, impersonation, or wire-fraud attempts — a request to change banking details, a vendor email that doesn't quite look right, an executive impersonation asking for an urgent transfer
• Unauthorized physical access to your office, server area, or networking equipment
• Unknown USB drive or device plugged into a company computer
• Tampering with company hardware — opened cases, missing components, unfamiliar peripherals

Evidence to Capture Before Reporting

Before submitting the report, gather as much of the following as you can. The more detail we have up front, the faster we can respond:

• Date and time you first noticed the issue
• Screenshots of error messages, ransom notes, suspicious dialogs, unusual browser address bars, or unexpected sign-in prompts
• Do not delete suspicious emails — if email is involved, preserve the original message. For phishing emails specifically, follow the steps in How to send us a suspicious email for automated analysis to forward it as an attachment so headers are preserved.
• Exactly what you were doing right before the issue appeared
• Any unusual prior activity — a slow computer, popups, password changes you didn't make, unexpected MFA prompts, missing or renamed files
• Affected files, accounts, and systems — which computer, which user account, which files or folders, which applications

How to Report a Security Incident

To ensure your incident is reviewed as quickly as possible, submit the online request first. Our team is mobile-first, and online submissions are our primary intake — submitting through the support portal is the fastest way for an on-call technician to be assigned.

1. Open the Security Concern form. It opens with the right request type already chosen. You can also open the main support request page and pick the Security Concern tile.
2. Check that the form shows Security Concern at the top and an IT Security Incident section below it. If it doesn't, click Change request type and pick Security Concern.
3. Provide the incident date (and time, if known)
4. In the Security Incident Information field, describe what happened, who is affected, and the suspected cause — include the evidence you gathered above
5. Submit the request
6. If the incident is still happening (ransomware spreading, an account being misused right now), start the description with Business-critical: so the on-call technician picks it up first

What Not to Do

While waiting for our team to respond, please do not:

• Pay any ransom under any circumstances — paying does not guarantee data recovery and can violate sanctions laws
• Attempt to "fix" or clean the system yourself — running cleaners, AV scans on your own, or restoring from backups before we've assessed the incident can destroy evidence and make the situation worse
• Notify customers, vendors, partners, or the public (including social media) before coordinating with company leadership and our team — premature disclosure can complicate response, legal, and insurance steps
• Email or message the suspicious account asking "did you send this?" — if the account is compromised, you may be alerting the attacker. Verify by phone or in person instead.

Our team will guide you on the appropriate containment, notification, and remediation steps for your specific incident once we've assessed it.