Triage cyber hotline calls, attacks in progress first

Fields

• How the incident was reported (hotline call, email or portal form)
• Call transcript, coordinator notes, email or form text

Questions

1. What kind of incident does the policyholder report? Choice

   When one incident has several parts, such as an email account taken over and then used to redirect a payment, choose the part that needs the fastest action, in this order: ransomware or extortion, payment fraud, data breach, account compromise, then the rest.

   • Ransomware or extortion Systems or files encrypted, or data stolen, with a demand to pay or a threat to publish.
   • Payment fraud Money paid, or about to be paid, to a fraudster through a fake invoice, changed bank details or an impersonated email.
   • Data breach Personal or confidential data exposed, sent to the wrong place or taken, with no demand and no payment involved.
   • Account compromise An email, cloud or other account taken over or misused, with no payment lost and no data known to be taken.
   • Lost or stolen device A laptop, phone, drive or other device holding business data lost or stolen.
   • Denial of service A website or service knocked offline by a flood of traffic.
   • Supplier incident An IT or service provider that holds or runs the policyholder's systems or data was attacked.
   • Claim against the policyholder A customer, regulator or other party seeks money or action from the policyholder over a past incident.
   • System failure An outage or fault with no sign of an attack.
   • Not a cyber incident A question about cover, a general enquiry, or a loss with no computer or data element.

2. Does the text say the attacker may still have access, or the attack may still be going on? Yes / No

   Yes: The text says the attack is still spreading, the attacker still has or may still have access (for example a password not yet changed, or new alerts arriving), or the caller does not know whether it has stopped. No: The text says the attack is over and access has been removed, such as systems cut off and passwords changed, or describes no attack.

3. Does the text say the business cannot operate normally because of the incident? Yes / No

   Yes: The text says key systems are down, work or trading has stopped, or appointments, orders or services are being cancelled. No: The business is working normally, or the text says nothing about it.

4. Does the text mention a ransom or extortion demand? Yes / No

   Count a ransom note, a demand to pay, or a threat to publish or leak data unless the policyholder pays or makes contact. Yes: The text mentions a demand or threat of this kind. No: No demand or threat is mentioned.

5. Does the text say money has already been paid to a fraudster or an attacker? Yes / No

   Yes: The text says money has already been paid out because of the incident, by the business or by one of its clients, including a payment the bank is now trying to recall. No: The text says no money has been paid, or a payment was stopped before it left, or mentions no payment.

6. Does the incident involve information about identifiable people? Yes / No

   Count information about customers, staff or others held in the systems, accounts or devices the text says were accessed, encrypted, forwarded or taken, such as client files, payroll or patient records. Yes: The text says or shows that systems, accounts or devices holding details about identifiable people were affected. No: The text says no personal data was involved, or describes no affected system that holds it.

7. Does the text say affected systems have been, or are about to be, wiped, rebuilt, restored or reset? Yes / No

   This goes to the incident response firm so it can preserve evidence first. Count a plan to do it even when the caller has been asked to wait. Removing a rule or blocking an account is not wiping. Yes: The text says a device, server or account has been or will soon be wiped, reinstalled, rebuilt, restored from backup or reset to factory settings. No: The text says nothing of this kind.

8. Does the text say the police or a national cyber or fraud reporting service has been told? Yes / No

   Yes: The text says the incident has been reported to the police or to a national reporting service. No: The text says it has not been reported, or does not say.

9. How fast must the response partners act on this notice? Scale

   Rate from what the text describes now, not from what might happen later.

   • Routine Next business day: the incident is over, contained, or a question with no loss happening now.
   • Same day Today: data may be exposed or an account was misused, but the attack has stopped and nothing is being lost now.
   • Within the hour An attack may still be under way, the business cannot operate, money has just been sent, or evidence is about to be wiped.

10. Is there enough in the text to tell what happened and what is affected? Yes / No

    Yes: The text says what happened and which systems, accounts, data or payments are affected, clearly enough to call the right partner. No: The text is too short or vague to tell, such as "we think we have been hacked, please call".

Lens columns

incident_type, incident_type_probability, active_now, active_now_probability, operations_down, operations_down_probability, ransom_demand, ransom_demand_probability, funds_sent, funds_sent_probability, personal_data_involved, personal_data_involved_probability, evidence_at_risk, evidence_at_risk_probability, police_told, police_told_probability, urgency, urgency_average, enough_information, enough_information_probability