APPSEC
CZ SK EN
INCIDENT RESPONSE

Help with a cyberattack

Encrypted files, a compromised account or a suspected data leak in your organisation? Contact APPSEC. We will assess the situation with you and agree assistance based on availability and your operational needs.

Call APPSEC +420 226 289 400 Describe your situation

We confirm availability and scope at first contact. We do not provide a standard round-the-clock response service; recovery and decryption cannot be guaranteed in advance.

FIRST STEPS

First steps in your organisation

Start by limiting spread, protecting backups and preserving evidence. These general steps draw on NÚKIB and CISA guidance. Coordinate them with your IT team and adapt them to safety and operational needs.

Disconnect affected devices from the network

Unplug the network cable, disable Wi-Fi or isolate the devices at the switch or firewall. If you can disconnect them, do not turn them off: memory may contain important investigative evidence.

Secure your backups

Identify unaffected backups and disconnect them from the network. Attackers often try to delete or encrypt backups.

Do not delete anything or reinstall systems yet

Leave affected systems, files and the attacker's message unchanged. Reinstallation would destroy evidence needed to establish how the attacker entered.

Next steps: logs, access and communication

Preserve logs and document your actions

Secure firewall, server, email and cloud service logs before they are overwritten. Record what you discovered, what you did and when.

Secure compromised access from a clean device

Disable or change passwords for accounts known to be compromised, using an unaffected device. Plan a wider password reset after the environment is cleaned so the attacker cannot intercept it.

Communicate outside compromised systems

The attacker may be reading company email and chat. Discuss the incident by phone or another channel outside the affected environment.

Notify your insurer and call us

If you have cyber insurance, contact your insurer as soon as possible; it may require a particular procedure or provider. Call APPSEC to agree the next steps.

HOW WE HELP

How APPSEC can help your organisation

We first agree involvement, access and scope with the responsible person in your organisation. Depending on the findings, assistance can cover the following areas.

Initial response and coordination

We discuss what your organisation is seeing, which services matter most and who is responsible for them. We help set priorities and coordinate your IT team, suppliers and management.

  • An initial assessment of the situation and attack scope.
  • A first-response plan with clear responsibilities.
  • Regular status summaries for management.

Containment and isolation

We help isolate affected devices and accounts and restrict suspicious connections. Specific actions are agreed with your IT team, taking operations and evidence preservation into account. We use available security tools where appropriate.

  • Isolating devices, network segments and compromised accounts.
  • Closing remote access and known malicious connections.
  • Optional rapid EDR deployment; according to their vendors, both platforms support endpoint isolation and malicious file quarantine.

Forensic analysis and identifying the entry point

We preserve available evidence and investigate the entry point, timeline and scope of the attack. We distinguish confirmed findings from unverified assumptions to support your next decisions.

  • Disk and memory images and preservation of logs.
  • An attack timeline and a list of affected systems.
  • The entry point and any hidden access left by the attacker.

Data and system recovery

Together with your IT team, we assess backups and set recovery priorities according to service importance. We help restore systems from verified sources or rebuild them from a clean foundation.

  • Verifying that backups are complete and clean.
  • Recovery according to operational priorities.
  • Clean installation and secure configuration of critical systems.

Decryption options

We assess the ransomware type and available public decryptors, including the No More Ransom project. We also consider backups, shadow copies and partially preserved files. Recovery options depend on the particular case.

  • Identifying ransomware from a sample and the attacker's message.
  • Checking available public decryption tools.
  • Recovering from shadow copies and partially encrypted files where possible.

Advice on communicating with the attacker

Your management team needs to understand what the attacker actually has and which claims are supported by evidence. We prepare technical findings for discussions with your legal advisers, insurer and relevant authorities.

  • Verifying what the attacker actually holds and whether their claims match the findings.
  • Coordinating any contact with management, legal counsel and the insurer.
  • Authorities advise against payment: it does not guarantee decryption or deletion of data and may finance further attacks.

Communication and reporting

We provide technical findings for any required reports and communications with customers, partners or employees. Your responsible officers and legal advisers assess obligations and approve the final wording.

  • Technical information for reports to NÚKIB, the Czech data protection authority and the Police of the Czech Republic.
  • Communication templates for customers, partners and employees.
  • Facts for your legal advisers and insurer.

After the incident: hardening and prevention

After containment and recovery, we help identify root causes and remediation priorities. Agreed follow-up can include access and configuration changes, testing of fixes or additional protection.

  • A hardening plan based on the identified causes.
  • Penetration testing to verify remediation.
  • An incident review and SentinelOne or Heimdal protection according to the proposal.
PROCESS

How we work together

We first confirm availability and agree APPSEC’s involvement. Throughout the response, you will know what we have found, what comes next and which decisions we need from you.

  1. 01

    First contact

    Briefly describe what is happening in your organisation. We check availability and agree whether and to what extent we can assist, along with a secure way to communicate.

  2. 02

    Assessment and scope

    We establish what is affected and at risk. We agree scope, authority, access and contacts.

  3. 03

    Containing the attack

    We isolate affected systems and accounts to prevent further spread. We coordinate with your operations team to avoid unnecessarily stopping services that still work.

  4. 04

    Investigation

    We preserve evidence and establish how the attacker entered, what they did and what they may have taken. The findings inform recovery, reporting and management decisions.

  5. 05

    Recovery

    We restore systems and data according to operational priorities, using verified backups or clean installations. Before returning to service, we check that the known attack paths have been closed.

  6. 06

    Follow-up measures

    We deliver a final report, lessons learned and recommendations. As agreed, follow-up may include hardening, penetration testing or deployment of protection.

WHO IS RESPONSIBLE FOR WHAT

Who is responsible for what

APPSEC

Technical assistance, coordination and findings to support your decisions within the agreed scope. Actions affecting operations follow the authorised access and approved response plan.

Your organisation

Decides on actions affecting operations, provides authority and access, and approves external communications. Any decision to contact the attacker belongs to management.

Vendors and insurer

SentinelOne Wayfinder MDR and Heimdal MXDR are vendor services if contracted. Your cyber insurer may require a particular process or provider, so contact it promptly.

Authorities and police

You can report a crime to the Police of the Czech Republic. A personal data breach may need to be reported to the Czech data protection authority, and organisations subject to Czech cybersecurity legislation may be required to report an incident to NÚKIB.

INCIDENT CONTACT

Tell us about your situation

Describe what you are seeing, when you discovered the problems, which systems are affected and what your IT team has already done. Include a phone number for a callback. Do not submit passwords, access credentials, logs or malware samples here; any transfer will be arranged securely.

Contact APPSEC

For initial contact, use the phone where possible. Briefly describe the problems in your organisation so we can agree availability and next steps. If your email may be compromised, use another secure communication channel.

Frequently asked questions

Your first questions

How do we agree scope and pricing?

We cannot determine a price without understanding the situation. We agree scope, charging arrangements and terms for the specific incident, and you confirm them before work starts. If the situation changes, we review the scope with you.

Should we pay a ransom?

The decision belongs to management together with legal counsel, the insurer and authorities. NÚKIB, US CISA and No More Ransom advise against payment: it does not guarantee decryption or deletion of stolen data, may finance further attacks and may carry legal risks, including sanctions-related risks. We help establish the facts on which to base your decision.

Can encrypted files be recovered?

That depends on the ransomware. Public decryptors exist for some families but not for many others. We therefore also assess backups, shadow copies and partially encrypted files. Success cannot be guaranteed.

We have cyber insurance. What should we do?

Contact your insurer as soon as possible and review the policy terms. It may require notification within a deadline, a particular procedure or a provider selected by the insurer. We coordinate our approach and provide technical information as agreed.

Do we have to report the incident?

This is general information, not legal advice. Under the GDPR, a personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to pose a risk to individuals. Organisations subject to Czech Cybersecurity Act No. 264/2025 Coll. may be required to report incidents to NÚKIB, primarily through the NÚKIB Portal; check the regime applicable to you. A crime can be reported to the Police of the Czech Republic.

When can APPSEC assist? Can you attend on site?

We do not normally offer round-the-clock incident response. Availability, work outside normal business hours and on-site attendance are agreed according to the situation and engagement scope. Many steps can also be performed remotely through securely configured access.

Sources behind our recommendations