This is not legal advice. It is an order of questions so you do not call everyone at once and do not wipe traces “for peace of mind”.
First, in-house
- What happened (symptom), since when, which account / host / service.
- Who in the organisation can approve cutting access or isolation.
- Whether anyone already rebooted, cleared logs or paid.
- Preserve material — IR checklist.
When the provider / bank / platform is enough
- Compromised mailbox at the mail provider — official recovery plus the account-takeover card.
- Suspected payment fraud (BLIK, transfer, fake checkout) — bank on the official number, not from an SMS.
- Social / marketplace account — report to the platform and warn contacts.
When technical help makes sense (e.g. tomek.st)
- You need facts from logs, containment and a written next step without destroying material.
- Suspected access to a host / VPN / RDP, not only one web account.
- You need calm triage before talking to an insurer or an authority.
Report an event — phone temporarily unavailable; form usually 1 business day. This is not a SOC roster.
When to involve CERT / CSIRT
- Mass attack, botnet, scanning of your infrastructure beyond a single firm.
- You want to share IoCs or use public sector assistance.
- In Poland, start from the relevant CSIRT (including CERT Polska) — use the current reporting channel on that CSIRT’s site.
They do not replace your isolation decision or the call to the bank.
When to call the police
- Clear financial loss, blackmail, threats, misuse of your identity for crime.
- You need a case number for the bank / insurer.
- You keep correspondence and do not “improve” evidence yourself.
When the GDPR / supervisory path applies
- There is (or is a high risk of) a personal-data breach: leaked database, mailbox with customer data, unauthorised HR access.
- Then: scope of data, categories of people, likely consequences; in defined cases notify the authority on a short deadline (often discussed as “72 hours” from awareness — details with counsel / DPO).
- That is a separate decision from a “SIEM alert” ticket.
Do not mix these up
| Situation | First move |
|---|---|
| BLIK code / transfer under fraud pressure | Bank |
| Fake AnyDesk support | Cut the session; bank if payment data was exposed |
| Ransomware on a company server | Owner-approved isolation, offline backup, IR — do not pay “because it is fast” |
| Customer list leaked | GDPR assessment + technical access cut |
| Suspected issue in tomek.st | Security disclosure |