How do I know if I've been hacked?

Common signs include: unusual system slowness or crashes, locked accounts, ransom messages, unexpected password resets, strange emails sent from your accounts, or alerts from security software. If something feels wrong, investigate. Trust your instincts.

Should I turn off my computer?

Usually no. Turning off a computer can destroy forensic evidence in memory. Instead, disconnect it from the network (unplug the ethernet cable, disable Wi-Fi) but leave it running. The exception: if ransomware is actively encrypting files and spreading, shutting down may limit the damage.

Do I need to report a breach?

It depends. Under GDPR, breaches involving personal data must be reported to the data protection authority within 72 hours if they pose a risk to individuals. Under NIS2, significant incidents must be reported within 24 hours. Even if not legally required, reporting to CCB (cert@ccb.belgium.be) can help you get assistance and helps protect others.

Should I pay a ransom?

We strongly advise against it. There's no guarantee you'll get your data back, it funds criminal organizations, and it marks you as a target for future attacks. Focus on restoring from backups instead. If you don't have backups, consult with law enforcement and cybersecurity experts before making any decisions.

How can I prevent this from happening again?

Focus on the basics: maintain regular tested backups (with offline copies), enable multi-factor authentication everywhere, keep systems patched and updated, train employees to recognize phishing, and have an incident response plan ready. Consider implementing the CyberFundamentals framework for structured security improvement.

Hacked? Here's What To Do: Incident Response Guide

Signs You've Been Hacked

The first step is recognizing that something is wrong. Here are common signs of a security breach:

Unusual system behavior

Slow performance, crashes, programs starting on their own

Locked out of accounts

Passwords no longer work, unexpected password reset emails

Ransom messages

Files encrypted, messages demanding payment

Strange network activity

Unexpected data transfers, connections to unknown servers

Security alerts

Warnings from antivirus, firewall, or monitoring tools

Customer complaints

Reports of spam from your email, suspicious invoices

⚠️Watch your management tools

MDM platforms (Microsoft Intune, Jamf), cloud admin consoles, and remote management tools are high-value targets. In March 2026, employees at Stryker reported their managed devices wiped remotely overnight, and the attackers (Handala) claimed 200,000 devices (BleepingComputer, March 2026). If an attacker gains access to these tools, they can control or destroy every enrolled device at once.

Unexpected device enrollment or unenrollment changes
Mass policy pushes or configuration changes you did not initiate
New admin accounts appearing on management consoles
Remote wipe or lock commands you did not send

Protect yourself: enforce MFA on all admin accounts, use separate credentials for admin consoles (never your daily-use account), monitor admin activity logs, and strictly limit who can issue remote wipe commands.

ℹ️Fast detection wins: two Belgian municipalities, five days apart

On April 16, 2026, municipal IT staff in Temse (East Flanders, ~30,000 residents) spotted unauthorised remote-monitoring software on council servers. They pulled services offline the same day and called in the CCB and shared-services partner Polis. The CCB confirmed on April 21 that no data had been exfiltrated, and full service was restored on April 23 (source: VRT NWS). A few days later, in April 2026, Anderlues (Hainaut) was added to the TheGentlemen ransomware group's dark-web leak site, with the incident confirmed to RTBF. Same type of target, same month, very different outcome: time-to-detection was the decisive variable between a week-long disruption and a multi-month ransomware recovery. Zoom out: the CCB recorded 635 incident notifications in 2025, up 70% year on year, with 144 account-compromise cases as the top category and 105 ransomware. The Belgian baseline is shifting fast, and detection capability is the only thing that bends the recovery curve.

Watch what leaves your network, not only what tries to get in. Stolen data shows up in outbound traffic first, so monitoring outgoing connections (egress monitoring) deserves as much attention as the firewall at the front door.

Immediate Steps: The First 15 Minutes

When you suspect a breach, these first actions are critical:

1

Don't panic

Take a breath. Rushed decisions often cause more damage. You have time to think.

2

Document what you see

Take photos of screens, note error messages, timestamps. This evidence is crucial.

3

Don't turn off computers

Unless ransomware is actively spreading. Evidence may be lost on shutdown.

4

Isolate affected systems

Disconnect from network (unplug cables, disable Wi-Fi). Don't turn off.

5

Call your IT partner

If you have one, contact them immediately. They can guide next steps.

Step-by-Step Response Plan

1

Contain

Stop the spread

Disconnect affected computers from the network
Disable remote access and VPN connections
Change passwords for critical accounts (from a clean device)
Block suspicious IP addresses at the firewall
Preserve evidence: don't delete or modify anything

2

Assess

Understand what happened

Identify which systems are affected
Determine what data may be compromised
Check backup systems: are they intact?
Review security logs for entry point
Identify the type of attack (ransomware, data theft, etc.)

3

Communicate

Inform the right people

Brief management and key staff
Prepare customer communication if data affected
Notify cyber insurance provider
Consider legal counsel for GDPR obligations
Document all communications

4

Recover

Restore operations

Verify backups are clean before restoring
Rebuild systems from known-good images
Restore data from offline backups
Reset all passwords across the organization
Patch vulnerabilities that enabled the attack

5

Report

Notify authorities if required

NIS2: Report significant incidents within 24 hours
GDPR: Notify data protection authority within 72 hours if personal data affected
File police report for criminal investigation
Notify CCB at cert@ccb.belgium.be for technical assistance

6

Learn

Prevent it from happening again

Conduct post-incident review
Identify what allowed the attack to succeed
Update security policies and procedures
Implement additional security controls
Train staff on lessons learned

Who decides, prepared in advance

Your IT partner restores, the owner decides what comes back first. Write that order down in advance.

ℹ️A real example

On 12 October 2026 Ahold Delhaize found a security issue and took some systems offline itself. The Delhaize and Albert Heijn websites went dark, but the stores stayed open and kept selling (AP, 13 October 2026). Shops that can run without part of their IT lose far less.

NIS2 Article 21 lists business continuity (backup management, disaster recovery and crisis management) among the required measures.

What CyFun asks: Basic needs an incident response plan with roles (RS.MA-01.1), a recovery process (RC.RP-01.1) and backups on a separate system (PR.DS-11.1). Fallbacks are not named at Basic, but they make the plan work. Important needs contingency and continuity plans that are established, communicated, maintained and tested (ID.IM-04.1). Essential needs essential functions to keep running with little or no loss until full recovery (RC.RP-02.1).

Who to Contact

Having the right contacts ready before an incident saves precious time:

Your IT partner . They should be your first call. Have their emergency number accessible.

CCB CERT . Belgium's Computer Emergency Response Team: cert@ccb.belgium.be or +32 2 501 05 60

Fraudstop . Belgium's central online-fraud emergency number: 078 170 170 (24/7, folded into Card Stop)

Local police . File a report for insurance and potential investigation

Cyber insurance . If you have a policy, notify them immediately

Legal counsel . For GDPR obligations and liability questions

NIS2 Reporting Requirements

If your organization falls under NIS2, you have strict reporting obligations:

24 hours Early warning to competent authority

72 hours Incident notification with initial assessment

1 month Final report with root cause analysis

14 days (CRA) Second clock, for makers of products with digital elements. The Cyber Resilience Act applies from 11 September 2026. Its first two steps are the same 24 hours and 72 hours, but the final report is due within 14 days of a fix being available for a flaw that is already being exploited. This one is owed by whoever makes the product, not whoever runs it.

Should You Pay the Ransom?

This is one of the most difficult decisions businesses face. Our recommendation: don't pay.

Why not to pay:

No guarantee you'll get your data back
Funds criminal organizations and encourages more attacks
Paying marks you as a target for future attacks
Decryption tools often don't work properly
May violate sanctions regulations

Cyber Insurance Considerations

If you have cyber insurance, act quickly:

Notify your insurer as soon as possible (check policy for timeframe)
Document everything: insurers need evidence for claims
Follow their incident response requirements
Keep receipts for all incident-related expenses
Don't admit liability without consulting your insurer

Preventing the Next Attack

Once you've recovered, strengthen your defenses: Ensure you have reliable backups, strong access controls, and email security in place.

Regular backups . Test them regularly. Keep offline copies.

Employee training . Most breaches start with phishing. Train your team.

Multi-factor authentication . Enable it everywhere possible.

Keep systems updated . Patch vulnerabilities promptly.

Incident response plan . Have a written plan before the next incident.

Security monitoring . Consider managed detection and response services.