# Reporting a Security Incident

# Reporting a Security Incident

*Adapted from GitLab's "Engaging the Security Engineer On-Call".*

**If in doubt, report it.** A false alarm costs a few minutes. An unreported compromise cost us weeks in 2026 (see Incident Reports).

## What counts as an incident

- A lost or stolen laptop, phone or USB drive that holds NFE data or saved passwords.
- **Leaked credentials**: your password or an app password typed into a suspicious page, pasted in chat or email, committed to code, or seen by someone else.
- A device that may be infected: pop-ups, unknown apps, antivirus alerts, browser extensions you didn't install.
- **Bounces or replies for mail you never sent.** This is the sign that someone is sending as you.
- Logins, devices or app passwords you don't recognise (Nextcloud → Personal settings → Security).
- Customer, partner or financial data shared with the wrong people.
- Anything strange on field equipment: meters, inverters, Raspberry Pi/OpenEMS devices changing settings on their own, unknown SSH logins.

## How to report

1. **Urgent** (you may be compromised right now, or customer power or data is affected):
   - Message the Security DRI directly in Nextcloud Talk **and** phone or WhatsApp them.
   - If you can't reach Talk or your NFE account (e.g. your password was changed), use your personal email or phone. Don't wait.
2. **Not urgent** (a suspicious email you didn't click, a question):
   - Post in the team Talk chat or message the Security DRI. Expect an answer within one working day.

Include:
- what you saw, and when (with timezone);
- which account, device or system;
- what you already did (clicked a link, entered a password, replied);
- screenshots or the original email. **Forward suspicious mail as an attachment; don't just describe it.**

## Phishing

- **Didn't engage** (no click, no reply): report it, then delete it or move it to Junk.
- **Engaged** (clicked a link, entered a password, opened an attachment, replied, sent money or gift cards): treat it as **urgent**. Change your password straight away from a device you trust, then report.

## What happens next

The Security DRI triages the report, sets a severity using the [severity matrix](https://bookstack.nearlyfreeenergy.com/books/security/page/security-incident-severity-matrix), and follows the [incident response guide](https://bookstack.nearlyfreeenergy.com/books/security/page/security-incident-response-guide). You may be asked to stay available to answer questions in the first hour.