First aid
Hacked? Do this first
Don't panic, but be quick. These steps limit the damage. In doubt, or do you want someone to look with you? Send us a message: we normally reply within one working day.
The first hour
Eight steps, in order
- Network off - Take infected devices off the network. Cable out, Wi-Fi off. Unplug your backup disk so it stays out of harm's way, and don't start deleting or cleaning up yourself; what's on the device helps the investigation.
- Call the bank - Transferred money, gave bank details or codes? Call your bank at once, on the number on your card or in the app. Every minute counts.
- Change passwords - Do it from another, clean device. Start with your e-mail, because that lets them reset everything else. Turn on two-step verification.
- Don't just pay - Ransomware? Don't pay in a panic. There's no guarantee you'll get your files back. Check nomoreransom.org for a free key and get help. If you're considering paying anyway, tell the police.
- Report it - Report it to the police, online or on 0900-8844. Keep e-mails, messages, account numbers and screenshots.
- Data breach? - Has personal data of customers or others got into the wrong hands? Then in many cases you must report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours.
- Warn people - Was something sent from your e-mail or phone? Let your customers and contacts know they should ignore those messages.
- Close the gap - Find out how they got in and close that door. Otherwise you'll be back here next month.
Useful contacts
Who does what
- Your bank: stopping money, blocking cards. Call the number on your card or in your banking app.
- Police: reporting ransomware or online fraud (in Dutch), online or on 0900-8844.
- Fraudehelpdesk: advice and reporting fraud (in Dutch), at fraudehelpdesk.nl, for businesses at fhdzakelijk.nl.
- No More Ransom: free keys for some ransomware, at nomoreransom.org.
- Autoriteit Persoonsgegevens: how to report a data breach, within 72 hours.
- 3D-eVo: looking with you, cleaning up and closing the gap. Send us a message.
Questions
Questions when it has already gone wrong
Should I pay the ransom?
Preferably not, and certainly not in a panic. There's no guarantee, and you fund the next attack. With a good backup you don't have to; that's why backups are the most important topic on this whole site.
I'm a bit embarrassed. Is that odd?
Not at all, and there's no need. These tricks are designed to fool clever people. Reporting it quickly helps more than fixing it quietly.
What do you do when I get in touch?
First we look at what's going on and what matters most right now. Then we help with cleaning up, restoring and closing the gap, remotely or on site.
Press play
Rather prevent than cure?
A security check costs you a morning and saves you this page.