Reporting a Security Incident
Reporting a Security Incident
Adapted from GitLab's "Engaging the Security Engineer On-Call".
If in doubt, report it. A false alarm costs a few minutes. An unreported compromise cost us weeks in 2026 (see Incident Reports).
What counts as an incident
- A lost or stolen laptop, phone or USB drive that holds NFE data or saved passwords.
- Leaked credentials: your password or an app password typed into a suspicious page, pasted in chat or email, committed to code, or seen by someone else.
- A device that may be infected: pop-ups, unknown apps, antivirus alerts, browser extensions you didn't install.
- Bounces or replies for mail you never sent. This is the sign that someone is sending as you.
- Logins, devices or app passwords you don't recognise (Nextcloud → Personal settings → Security).
- Customer, partner or financial data shared with the wrong people.
- Anything strange on field equipment: meters, inverters, Raspberry Pi/OpenEMS devices changing settings on their own, unknown SSH logins.
How to report
- Urgent (you may be compromised right now, or customer power or data is affected):
- Message the Security DRI directly in Nextcloud Talk and phone or WhatsApp them.
- If you can't reach Talk or your NFE account (e.g. your password was changed), use your personal email or phone. Don't wait.
- Not urgent (a suspicious email you didn't click, a question):
- Post in the team Talk chat or message the Security DRI. Expect an answer within one working day.
Include:
- what you saw, and when (with timezone);
- which account, device or system;
- what you already did (clicked a link, entered a password, replied);
- screenshots or the original email. Forward suspicious mail as an attachment; don't just describe it.
Phishing
- Didn't engage (no click, no reply): report it, then delete it or move it to Junk.
- Engaged (clicked a link, entered a password, opened an attachment, replied, sent money or gift cards): treat it as urgent. Change your password straight away from a device you trust, then report.
What happens next
The Security DRI triages the report, sets a severity using the severity matrix, and follows the incident response guide. You may be asked to stay available to answer questions in the first hour.