Security incident
Suspect a cyber attack? Start with the first steps
Email contact@beregit.com with the subject INCIDENT — we handle these requests first. While you wait for our reply, take the steps below: they limit the damage and preserve evidence.
First steps
What to do right now
Isolate, don’t switch off
Disconnect affected computers and servers from the network (cable, Wi-Fi, VPN). Don’t power them off or reinstall: memory and logs hold traces of the attack.
Record what you see
Take screenshots of any messages, note the time, file names and addresses. Don’t delete suspicious emails or files.
Protect accounts
From a clean device, change administrator, email and remote-access passwords and turn on two-factor authentication. Block accounts that may be compromised.
Don’t pay the ransom
Don’t reply to the attackers or pay until you have assessed the situation with specialists: paying does not guarantee you get your data back.
Protect your backups
Disconnect backup storage from the network so it is not encrypted, and don’t restore data until it is clear how the attack happened.
Name one person in charge
One person collects the facts and handles communication. Ask staff not to discuss the incident in channels that may be compromised.
Your request
What to include in your email
The more precise the description, the faster we can assess the scope and propose a plan.
- Company name and contact person
- How to reach you quickly: phone or messenger
- What happened and when you noticed it
- Which systems, services or how many users are affected
- What you have already done: isolation, password changes and so on
- Whether we already have access to your systems, if you are a client
Notifications
Who else to notify
- CERT-UA (cert.gov.ua) — Ukraine’s government computer emergency response team.
- The Cyber Police (cyberpolice.gov.ua) if there are signs of a crime: extortion, fraud, theft of funds.
- The data protection authority if personal data of people in the EU is affected: the GDPR requires notification within 72 hours (Art. 33).
- Your insurer, if you have a cyber insurance policy — before any recovery work.
How we help
From the first signal to the report
- TriageWe assess the scope and severity and agree the first actions with you.
- ContainmentWe isolate affected systems and accounts to stop the attack from spreading.
- InvestigationWe analyse logs and security events, find out how the intrusion happened and remove its consequences.
- Recovery and reportWe bring systems back from clean backups and prepare a report with recommendations so it does not happen again.
Related services
Has an incident already happened?
Email us with the subject INCIDENT — we handle these requests first.