What are the different types of cybersecurity incidents?

Cybersecurity incidents fall into a few broad families: malicious code (including ransomware), intrusion and account compromise, data breaches (theft, leak or alteration), loss of availability (denial of service) and fraud. The type of incident steers the priorities of the response and the notifications to consider.

This article is part of our incident response series. For the big picture, see What is incident response?.

A reference classification

There is no single official list. European response teams often rely on the reference taxonomy published by ENISA, the EU cybersecurity agency, which grew out of work by CSIRTs and law enforcement. It groups incidents into broad classes: abusive content, malicious code, information gathering, intrusion attempts, intrusions, availability, information content security, fraud and vulnerabilities.

For an SME or an MSP, a simpler version does the job. Here it is, with what each type means for the response.

Incident type	Example	Response priority
Ransomware	Encrypted servers, ransom note	Isolate, protect backups, preserve evidence
Other malware	Trojan, credential stealer	Identify affected devices and what was stolen
Account compromise	Microsoft 365 mailbox taken over after phishing	Revoke sessions, reset, look for forwarding rules
Payment fraud	Fake bank detail change sent from a compromised mailbox	Alert the bank quickly, report to police
Network intrusion	Exploited VPN or exposed server	Close the entry point, hunt for lateral movement
Data breach	Customer files exfiltrated	Assess the scope, consider the notification provided for by the GDPR
Denial of service	Website or service knocked offline	Filter traffic, switch to fallback options
Insider misuse	Former employee who kept access	Revoke, trace, keep evidence
Supplier compromise	Remote management tool hijacked	Cut the supplier’s access, check every linked client

The most common incidents in business

Ransomware

The most visible incident. French government guidance from Cybermalveillance.gouv.fr describes a typical pattern: entry through a vulnerability, a poorly protected remote access or an account stolen through phishing, then encryption of data, often preceded by data theft used as extra leverage. Attackers also try to destroy backups. See Ransomware attacks in 2024: the most affected companies.

Email compromise

A stolen mailbox lets attackers read conversations, set up hidden forwarding rules and send fake payment requests to customers or suppliers. In Microsoft 365 environments, these attacks often go unnoticed without monitoring. See Microsoft 365 attacks MSPs do not see coming.

Data breach

Almost any other incident type can lead to one. For the notification provided for by Article 33 of the GDPR, to the supervisory authority and in principle within 72 hours, it is the nature of the data affected that counts, not the attack method. See Who should you contact after a cyberattack?.

One incident, several types

In practice, types chain together. Phishing leads to a compromised account, which opens the network, which leads to data theft and then encryption. Classification matters most at the start, to steer the first actions, and it evolves as the investigation progresses.

The MSP case

MSPs face a specific kind of incident: compromise of their own tools (remote management, monitoring, admin accounts), which can open the door to several clients at once. Commission Implementing Regulation (EU) 2024/2690 sets out when an incident is significant for several categories of digital providers, including managed service providers and managed security service providers. Monitoring all clients from one place helps spot these cascading attacks. See What is a multi-tenant SOC for MSPs?.

What it means for the response

The type of incident does not change the main stages of the response: triage, containment, investigation, eradication, recovery and lessons learned. It changes the order of priorities and who needs to be involved. See How does incident response work?.

Talk to an expert

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

To find out which incident types your monitoring covers today, your Cyna partner MSP is your first point of contact. Otherwise, get in touch.

Frequently asked questions

Is a blocked attack attempt an incident?

It is usually a security event. It becomes an incident if it compromised, or could have compromised, the availability, integrity or confidentiality of systems or data. See What is a cybersecurity incident?.

Which incidents are concerned by notification to the data protection authority?

According to GDPR Article 33, what matters is a personal data breach (destruction, loss, alteration, disclosure of or unauthorised access to personal data), whatever the attack type, unless it is unlikely to result in a risk to people. A specific case is best assessed with the DPO or a legal adviser.

Is an outage without an attack a cybersecurity incident?

An accidental outage can fall within the broad NIS2 definition of an incident, which covers any event compromising availability, integrity or confidentiality. It is mainly handled through business continuity, though, rather than an investigation.