Identify
Confirm what happened, when it started, and which accounts, devices, or users may be affected.
What to Do First
Confirm what happened, when it started, and which accounts, devices, or users may be affected.
Disconnect affected devices if needed, isolate compromised accounts, and stop the threat from spreading.
Keep screenshots, suspicious emails, timestamps, and system notes that may support later investigation.
Restore trusted access, reset credentials, monitor for recurrence, and review what needs to change.
Use the report pathway to share the incident details with the right context and urgency.
Report Incident