First real security incident, what to do in order

A compromised account or ransomware on a laptop feels like panic. The first minutes decide how big the damage gets. Work through a prepared plan, not ad-hoc decisions.

Try this first

1. 1Isolate the suspect device or account immediately, cable out and wifi off, or account suspend, before doing anything else.
2. 2Change passwords on the affected account and any accounts tied to the same mailbox or phone, that is usually more than you think.
3. 3Document what you see, screenshots, timestamps, error messages, before you clean up, that matters later for insurer and possibly authorities.
4. 4Assess whether you have a GDPR notification duty toward the Autoriteit Persoonsgegevens, you report a personal-data breach within 72 hours, not 'when we finish investigating'.
5. 5Bring in your cyber insurer if you have one, they often want their own forensic team and that needs to go before you start cleaning up.
6. 6Communicate to affected customers and staff with facts, not reassurances, honesty builds trust, smooth messages break it.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.