What should I do right now to protect our company data after the telecom cyberattack?

First thing to do is call your bank and put a strict approval rule on direct debits. Make sure only pre-approved companies can withdraw funds, and any new request must go through accounting for sign-off. That's usually the loophole attackers exploit.

If you have SMS-based 2FA on company emails or bank accounts, move them to authenticator apps immediately. If the carrier's infrastructure was compromised, there's a real risk of SMS verification codes being intercepted via SIM swapping.

Send an urgent internal memo to all staff: do not click any links in SMS or emails that claim to be from the provider. Expect a surge in fake messages claiming "your bill is overdue" or "your line has been suspended" over the coming days.

We were with another provider that had a similar leak two months ago. Two weeks after the incident, our accounting received a fake invoice email for 840 euros that looked totally legit. It even had our actual customer number on it; we caught it at the very last second. Stay extremely alert.

Did the carrier's corporate portal hold your office's static IP forwarding rules or remote access configurations? Have you asked them for specifics on whether attackers only accessed billing data or compromised network management permissions too?

edit: fixed a few typos.

we are on the same carrier total panic since yesterday morning. called the bank right away and locked sepa mandates. also warned our accountant not to reply to emails from unknown senders.

In the event that corporate identity and banking data have been leaked following a cyber incident, all formal notices issued by the carrier should be carefully archived, and bank account activity should be audited on a daily basis.

After a similar leak last year, someone tried to SIM swap one of our partner's company lines. Luckily, they noticed their phone suddenly lost reception late at night and called the bank immediately to freeze the accounts. If any of your lines lose signal for no reason, act right away.

thanks for poosting and like most incidents start with a leaked password, not a vulnerability.

the real issue isnt the number but what its based on. of couurse it varies if your situation is different.

I agree, and I'd like to emphasize that. Trying to do this alone is the most expensive way.

Everyone rushing into what to do after telecom breach gets stuck at the same point. Good luck with that.

We experienced almost the exact same thing last year. If you dont write this down from the start, it leads to arguments later.

You're right, I've been down that road too. The real issue isn't the number, but what it's based on.

You're right. Everything goes well for the first three months; problems arise in the fourth.

If I were you, I'd go this route.

Im a small business let me explain from my side. Hasty decisions become decisions you have to fix six months later.

If permission and scope arent in writing dont start that test. tbh correct me if Im wrong.

Correct.

There's a part I don't understand. Taking measures without an inventory leaves doors you haven't seen open.

If I were you, I'd go this route.

Let me share what happened to me; it might be useful. An untested backup is not a backup.

Solutions that work at a small scale collapse when you grow; I learned this late. Good luck with that.

I partly agree partly disagree. If you get three different answers on a topic, the question was asked wrong.

Don't hesitate to ask; those who don't ask always pay more. I'm also curious if anyone does it differently.