Reporting a Security Incident

Reporting a Security Incident

Adapted from GitLab's "Engaging the Security Engineer On-Call".

If in doubt, report it. A false alarm costs a few minutes. An unreported compromise cost us weeks in 2026 (see Incident Reports).

What counts as an incident

• A lost or stolen laptop, phone or USB drive that holds NFE data or saved passwords.
• Leaked credentials: your password or an app password typed into a suspicious page, pasted in chat or email, committed to code, or seen by someone else.
• A device that may be infected: pop-ups, unknown apps, antivirus alerts, browser extensions you didn't install.
• Bounces or replies for mail you never sent. This is the sign that someone is sending as you.
• Logins, devices or app passwords you don't recognise (Nextcloud → Personal settings → Security).
• Customer, partner or financial data shared with the wrong people.
• Anything strange on field equipment: meters, inverters, Raspberry Pi/OpenEMS devices changing settings on their own, unknown SSH logins.

How to report

1. Urgent (you may be compromised right now, or customer power or data is affected):
   • Message the Security DRI directly in Nextcloud Talk and phone or WhatsApp them.
   • If you can't reach Talk or your NFE account (e.g. your password was changed), use your personal email or phone. Don't wait.
2. Not urgent (a suspicious email you didn't click, a question):
   • Post in the team Talk chat or message the Security DRI. Expect an answer within one working day.

Include:

• what you saw, and when (with timezone);
• which account, device or system;
• what you already did (clicked a link, entered a password, replied);
• screenshots or the original email. Forward suspicious mail as an attachment; don't just describe it.

Phishing

• Didn't engage (no click, no reply): report it, then delete it or move it to Junk.
• Engaged (clicked a link, entered a password, opened an attachment, replied, sent money or gift cards): treat it as urgent. Change your password straight away from a device you trust, then report.

What happens next

The Security DRI triages the report, sets a severity using the severity matrix, and follows the incident response guide. You may be asked to stay available to answer questions in the first hour.