Emergency

Company hacked: what to do in the first hour.

Disconnect the affected machines from the network, without switching them off. Alert your IT provider and management. Pay nothing. If the emergency is acute, call the police, then report the attack to the cyber authority of your country: the contacts for Switzerland, France, Belgium, Germany and Austria are below. Keep every trace: they will be needed by the police, the insurer and for the recovery. The details, in order, follow.

Ryze Cyber is not an emergency service. This page brings together the instructions of the authorities. If an attack is under way, your first contacts are your IT provider, the police and the cyber authority of your country.

What to do, in order

Isolate the affected machines. The Swiss National Cyber Security Centre (NCSC) asks you to disconnect infected systems from the network immediately: unplug the network cable and switch off the device's Wi-Fi.
Do not switch them off or restart them. According to the NCSC, a restart or an attempted repair makes the analyses that follow almost impossible. In France, Cybermalveillance.gouv.fr asks you not to switch off the affected machines, so as not to erase the evidence held in memory. One exception: if the encryption is still running and can be interrupted, hibernating the machine is worth considering.
Alert the right people. Your IT provider, management, and the person named in your emergency plan if you have one. Use the phone: the company's email may be compromised.
Keep the traces. Note the time, what you saw, the messages displayed. Have the log files saved. If your backups are encrypted too, the NCSC recommends keeping them: a decryption solution may appear later.
Do not pay. See the official position below.
Call the police. Straight away if the emergency is acute, later to file a complaint. The numbers and services by country are in the tables below.
Report to the cyber authority of your country. The NCSC in Switzerland, 17Cyber and Cybermalveillance.gouv.fr in France, the CCB in Belgium, the BSI in Germany, the Federal Office for Cybersecurity in Austria.
Check whether personal data is affected. If so, a report to the data protection authority may be mandatory (see below).
Tell your insurer if you have cyber insurance, before incurring costs. Your terms may require immediate notification.
Change the passwords from a clean device, starting with email and administrator accounts.

Who to contact in Switzerland?

Who	When	How
Police	Straight away in an acute emergency. Afterwards for the criminal complaint.	117 for emergencies. The cantonal police of your registered office for the complaint. Contacts by canton on the Western Switzerland page.
NCSC (National Cyber Security Centre)	As soon as possible. Voluntary report for most small businesses, mandatory within 24 hours for critical infrastructure.	report.ncsc.admin.ch. The NCSC points out that reports are not processed around the clock.
FDPIC (data protection)	"As quickly as possible", if the breach is likely to lead to a high risk for the persons concerned (FADP, Art. 24).	DataBreach form.
Your clients	If you process data on their behalf: as quickly as possible.	Through the contact set out in your contract.

A report to the NCSC is not a complaint: the NCSC cannot register criminal complaints. The deadlines and the cases where reporting is mandatory are detailed in legal obligations by country.

Who to contact in France?

Assistance: Cybermalveillance.gouv.fr, the national scheme for assisting victims, and 17Cyber, a service offered by the National Police, the National Gendarmerie and Cybermalveillance.gouv.fr.
Complaint: the CNIL advises filing a complaint at a police station or with the gendarmerie and keeping the technical evidence available for investigators.
Personal data: notification to the CNIL without undue delay, within 72 hours where feasible, when the breach presents a risk for the persons concerned. A two-stage notification is possible.

Who to contact in Belgium?

Police: 101 for urgent police assistance, 112 for an ambulance or the fire brigade (112.be).
Cyber authority: the Centre for Cybersecurity Belgium (CCB), which is the national CSIRT. It answers by email (info@ccb.belgium.be) Monday to Friday, from 09:30 to 16:30. Its round-the-clock phone line is reserved for providers of essential services and critical infrastructure. Forward suspicious messages (phishing) to suspicious@safeonweb.be. Entities covered by the NIS2 law have a separate notification procedure (see legal obligations by country).
Personal data: notification to the Data Protection Authority (APD/GBA) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk. The notification goes through the authority's portal, in French, Dutch or German: notifications sent by email are not processed.

Belgian contacts taken from the official websites on 8 October 2026.

Who to contact in Germany and Austria?

Country	Police	Cyber authority	Personal data
Germany	The police forces of the federal states each run a central cybercrime contact point reserved for companies and public bodies (ZAC). The right ZAC is the one for the company's registered office or the place of the incident. List and phone numbers on polizei.de.	The Federal Office for Information Security (BSI) receives voluntary reports from companies through its portal. Entities subject to NIS2 have a separate reporting channel.	The data protection authority of the federal state, within 72 hours where feasible (GDPR, Art. 33). List published by the BfDI.
Austria	133 for the police, 112 for the European emergency number. A complaint can be filed at any police station. The Federal Criminal Police Office (Bundeskriminalamt) runs a cybercrime contact point that gives information around the clock by email (against-cybercrime@bmi.gv.at), but a complaint cannot be filed through it.	The Federal Office for Cybersecurity: mandatory reporting for essential and important entities, voluntary reporting for the others.	The Data Protection Authority, through an online form, within 72 hours where feasible.

Contacts taken from the official websites on 7 October 2026. The number 112 works in every Member State of the European Union.

Ransomware: should you pay the ransom?

The position of the Swiss National Cyber Security Centre is set out in black and white:

"The NCSC recommends not paying a ransom. Once the ransom has been paid, there is no guarantee that the criminals will not publish the data anyway, or otherwise try to profit from it. Moreover, every successful ransom attempt motivates the attackers to continue, finances the further development of attacks and encourages their spread."

The NCSC adds that if you are still considering paying, it urgently recommends that you discuss this step with the cantonal police. In France, Cybermalveillance.gouv.fr gives the same instruction: do not pay the ransom demanded. In Germany, the BSI points out that paying offers no guarantee of getting your data back and recommends filing a complaint without delay.

Before any decision, check whether a key already exists: the NCSC refers to nomoreransom.org, a project of the Dutch police and Europol in which the Swiss Confederation takes part.

And after the first hour?

The aim, according to the NCSC, is to find out how the attacker got in, to avoid a new infection. The affected systems have to be reinstalled before the data is restored from the backups. If nobody in your company has these skills, call in a specialised firm.

Once the business is running again, two questions remain open: how did they get in, and is it closed again? This is where the Red Team and Blue Team pairing makes sense: an audit to find the open doors, then follow-up so that they stay closed. The Ryze Cyber Blue Team also covers preparation: knowing who calls whom, before the day it happens.

Frequently asked questions

Should you switch off an infected computer?

As a general rule, no. Disconnect it from the network (cable and Wi-Fi), but do not switch it off or restart it. According to the Swiss NCSC, a restart makes the analyses that follow almost impossible. Cybermalveillance.gouv.fr provides for one exception: if the encryption is still running, hibernating the machine is worth considering.

Should you pay the ransom?

The Swiss National Cyber Security Centre recommends not paying: nothing guarantees that the criminals will not publish the data, and a successful ransom attempt finances the next attacks. If you are considering it all the same, talk to the police first.

In Switzerland, must a small business report a cyberattack to the NCSC?

The obligation to report within 24 hours only targets critical infrastructure. For other companies, reporting is voluntary and recommended by the NCSC.

Is reporting to the NCSC the same as filing a complaint?

No. The NCSC cannot register criminal complaints. The criminal complaint is filed with the cantonal police of your registered office.

Does Ryze Cyber respond to emergencies?

Ryze Cyber is not an emergency service and does not advertise immediate intervention on its website. If an attack is under way, contact your IT provider, the police and the cyber authority of your country. Ryze Cyber works beforehand, to test and to protect.

Better to know beforehand.

The Ryze Cyber free scan is a 10-question questionnaire. It takes two minutes, the score appears straight away and nothing is tested on your systems.

Take the free scan →

Sources

Last updated: 8 October 2026