Who should you contact after a cyberattack?

After a cyberattack, the first contact is your MSP or incident response provider, to contain the attack and preserve evidence. Then come the police report, notification to the data protection authority if personal data is affected (the GDPR provides for 72 hours), your insurer and, for entities in scope of NIS2, the national CSIRT or competent authority.

This article is part of our incident response series. For the big picture, see What is incident response?.

The right order at a glance

Who	When	Why
MSP, SOC or incident response team	Immediately	Contain the attack, preserve evidence
Police or public prosecutor	Before wiping or rebuilding systems	Criminal investigation; may matter for insurance
Data protection authority	Within 72 hours if personal data is affected, under the GDPR	GDPR Article 33
Insurer	As early as your policy requires	Claim, approved providers, covered costs
National CSIRT or competent authority	If you are in scope of NIS2, or need state support	NIS2 Article 23 reporting, technical help
Customers, staff, partners	Depending on the situation	Transparency and, where required, GDPR Article 34

1. Your MSP and incident response provider

The first call is technical. Someone has to isolate affected machines, cut the attacker’s access and preserve traces. French government guidance recommends alerting your IT provider straight away, disconnecting affected machines from the network without switching them off (unless encryption is still running) and unplugging any backups that are connected.

If your MSP works with a managed SOC and a CERT, they take over the investigation. See What happens when a managed SOC detects an attack? and What is a CERT in cybersecurity?.

2. The police

A cyberattack is a crime. How you report it depends on your country: a police station, a national online reporting service or a written complaint to the public prosecutor. A widely shared recommendation, made in France by Cybermalveillance.gouv.fr: report before rebuilding the affected machines, so that the technical evidence is still available to investigators.

Reporting can also have a financial angle: filing a complaint may matter when an insurer handles a cyber claim. The conditions that apply to your situation are a question for your insurer and your legal adviser. When in doubt, do not wait: the report serves the investigation first, and evidence fades quickly.

3. The data protection authority

If the attack exposed, altered, encrypted or destroyed personal data, Article 33 of the GDPR provides for notification to the lead supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to people. Where the risk is high, Article 34 also provides for informing the people concerned. The European Data Protection Board lists every national authority; in France, it is the CNIL.

Who notifies, and who informs whom, depends on each party’s role under the GDPR and on the contracts between the company and its providers. These points are best clarified before an incident, with your legal adviser.

4. Your national CSIRT or competent authority

Article 23 of NIS2 provides for entities in scope to report significant incidents to their CSIRT or competent authority: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Each Member State designates its own bodies; the CSIRTs Network site lists national CSIRTs across the EU.

National CSIRTs also help beyond legal duties, within their remit. In France, according to its own guidance, CERT-FR handles incidents affecting the administration, operators of vital importance and NIS2 entities, and directs SMEs, mid-sized companies and local authorities towards regional CSIRTs and the 17Cyber assistance service. Note that, as of 17 September 2026, France had not yet adopted its NIS2 transposition law. See Is incident response mandatory?.

5. Your insurer

If you hold cyber insurance, notify your insurer early and read the policy: reporting deadlines, approved providers and covered costs vary from one contract to another.

The MSP as conductor

When a client is attacked, the MSP often coordinates everything: it brings in the SOC and the CERT, keeps a timeline of actions and helps the client prepare the police report and notifications. Writing this contact list before an incident, with on-call numbers and who owns each call, saves precious time. See Incident response vs crisis management and What to do in the first hours of a cyberattack.

Talk to an expert

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

To prepare your contact list and crisis organisation, your Cyna partner MSP is your first point of contact. Otherwise, get in touch.

Frequently asked questions

Should every company report an attack to its national CSIRT?

Not necessarily. Article 23 of NIS2 provides for entities in scope to report significant incidents to their CSIRT or competent authority. In France, for example, CERT-FR handles incidents affecting public administration, operators of vital importance and NIS2 essential and important entities, while smaller organisations are pointed towards regional CSIRTs and the 17Cyber service.

Can a CSIRT take my police report?

No. CERT-FR, for instance, states that it is not a police or judicial service and does not receive complaints. Reporting a crime goes through the police or the public prosecutor, according to your country's procedures.

What does the GDPR say about breaches at a service provider?

Article 33(2) of the GDPR provides that a "processor" notifies the "controller" without undue delay after becoming aware of a personal data breach. Who plays which role in your situation depends on your contracts: your legal adviser can confirm it.

Should we pay the ransom?

French government guidance from Cybermalveillance.gouv.fr advises against it, as nothing guarantees you will get your data back or that it will not be leaked. See Does incident response include data recovery?.