IT Security Incident?
We help immediately.
When ransomware, data breaches, or compromised systems strike, every minute counts. Our certified incident response experts are standing by - by phone, remotely, or on-site.
Available 24/7 for acute security incidents
Immediate Measures
What you should do right now
Before you call us - these steps help limit the damage:
- 1
Disconnect affected systems from the network immediately
Unplug network cables, disable Wi-Fi - but do NOT power off devices (evidence preservation).
- 2
Do NOT change passwords on affected systems
Use a separate, non-compromised device for any password changes.
- 3
Document screenshots and timestamps
Photograph screen messages with your phone. Note down when the incident was first discovered.
- 4
Call the AWARE7 emergency hotline
+49 209 8830 6766 - We take it from here.
Incident Response Process
What happens after your call
Immediate Intake
We gather the most critical information about your organization and the incident - affected systems, scope, and initial indicators.
Initial Phone Consultation
Our incident response specialists provide first actionable guidance for damage containment - isolating systems, preserving evidence, managing communications.
On-Site or Remote Deployment
Our experts begin forensic analysis, containment, and recovery - remotely or on-site at your location as needed.
Recovery & Hardening
We support the secure recovery of your systems, document the incident for authorities and insurers, and harden your infrastructure against follow-up attacks.
Our Areas of Expertise
We respond to every type of security incident
Our incident response team has experience with all common attack scenarios - from ransomware and business email compromise to complex supply chain attacks. Regardless of the incident type, we bring the expertise to respond quickly and systematically.
Preparation
Documents you should have ready
The faster you can provide these documents, the more efficiently we can respond.
-
Cyber insurance policy
Policy number, coverage limits, insurer's hotline, and claim notification form.
-
Network and system documentation
Network diagram, IP address ranges, server inventory, software and versions in use.
-
IT service provider contracts
Contact details of hosting providers, managed service providers, cloud vendors, and their SLAs.
-
Backup documentation
Backup locations, timestamp of last backup, recovery procedures.
-
Emergency contact list
CEO/management, IT leadership, data protection officer, legal department, PR/communications.
Reporting Obligations & Authorities
Official contacts in an emergency
Depending on the incident, there may be legal reporting obligations. We assist you with the coordination.
ZAC North Rhine-Westphalia
Central Cybercrime Contact Point - State Criminal Police NRW
ZAC Lower Saxony
Central Cybercrime Contact Point - State Criminal Police Lower Saxony
BSI - Reporting and Information Portal
Germany's Federal Office for Information Security - incident reporting for organizations (anonymous reporting possible)
BSI IT Emergency Card (printable)
Germany's Federal Office for Information Security (BSI) provides a free IT emergency card - designed to be printed and posted at workstations. It contains the most important behavioral guidelines for employees during an IT security incident.
View BSI IT Emergency CardObserve legal reporting deadlines
- GDPR Art. 33: Notification to data protection authority within 72 hours if personal data is affected
- Critical Infrastructure / NIS-2: Immediate notification to Germany's BSI for significant IT disruptions
- Cyber insurance: Claim notification per policy terms - typically within 24–48 hours
Your Advantages
Why AWARE7 in an emergency
Response time under 1 hour
Initial phone assessment and actionable guidance within 60 minutes of your call.
ISO 27001 certified
Our processes and your incident are handled according to certified standards - relevant for insurers, authorities, and business partners.
Experienced specialists
OSCP, OSCE, and GIAC certified pentesters and forensic analysts with experience from hundreds of security projects.
Structured documentation
Comprehensive incident documentation for your cyber insurance, business partners, and regulatory reporting obligations (GDPR, NIS-2).
Based in Germany
Headquartered in Gelsenkirchen, quick on-site availability in NRW and throughout the DACH region. All data stays in Germany.
Prevention after the incident
After resolution, we analyze the attack vector and harden your systems - so the same attack doesn't work twice.
Frequently Asked Questions
Common questions we get asked
How much does an incident response engagement cost?
Are you available on weekends and public holidays?
Do we need to report the incident to authorities?
Can you help remotely or do you need to be on-site?
What is an incident response retainer and is it worth it?
Does our cyber insurance cover the costs?
Incident Response Retainer
Be prepared before it happens
With an incident response retainer, you agree in advance on guaranteed response times, dedicated contacts, and pre-established processes. In an emergency, you don't lose valuable time on contract negotiations.
< 4h
Guaranteed response time
Dedicated
Team contacts assigned
Pre-configured
Access & playbooks ready
1x/Year
Incident response drill included
