Incident? The first hour matters most.

Money has already been transferred to a fraudster

• Call your bank immediately. A payment can sometimes be stopped, but only quickly.
• Report it to the police. In an emergency, call 112.
• Keep all emails and invoices. Don't delete anything; they are evidence.

Forged emails are being sent in your name

• Warn your clients and partners not to pay new invoices without confirming with you by phone.
• Notify CERT-EE at cert@cert.ee and include a sample of the email. Other contacts are on ria.ee.
• Have your IT partner set up DMARC. See the guide.

The website has been hacked or is down

• Contact your hosting provider or IT partner.
• Change the admin passwords and turn on two-step authentication.
• Don't delete logs or files. They show what happened.

Customer data may have leaked

A personal data breach must be reported to the Estonian Data Protection Inspectorate within 72 hours of discovering it. Write down what you know, even if the picture isn't complete yet.