We fell victim to a cybercrime: file a complaint or notify first, and who do we contact in France?

Right now, literally just pull the ethernet cables and shut off wifi on the machines. Never turn the system off. Then check the initial response steps tailored to your business size on the official French cyber support platform Cybermalveillance and open a ticket; they will also point you to accredited tech specialists in your area.

Bring your technical staff along when filing the complaint with the prosecutor. Police officers often struggle to interpret technical logs. Put the logs, the ransom note, and a list of impacted systems on a USB stick and make sure it's formally entered into the police report as forensic evidence. Without that official report, you won't see a single cent from insurance.

We dealt with a similar incident last year and barely made the CNIL notification at the 68th hour. Even though the suspected breach wasn't confirmed, no penalty was issued because we reported on time. On the other hand, an acquaintance who informed their insurer after 72 hours got their 30,000 Euro recovery costs denied because they blew past the policy deadline. Timing is everything.

Your first 48 hours checklist should look like this: 1) Physically disconnect network cables and isolate systems. 2) Call your cyber insurance agency's emergency hotline. 3) Fill out the data breach notification form on the CNIL website. 4) Go to the police station and file an official complaint (plainte) to get the report. 5) Try restoring your clean backups in an isolated test environment.

Filing a police report is a legal requirement and a must for insurance, but don't expect them to recover your systems. The police collect evidence and track down the culprits. What will actually save your business is whether your offline backups really work; test immediately on an external network to see if those backups are corrupted.

Keeping an internal crisis log regarding the potential compromise of personal data will work in your favor legally. The moment the incident was discovered, the technical measures taken, and the official filings made should all be recorded hour by hour. These records serve as primary evidence of due diligence before CNIL auditors.

definitely do not pay the ransom there are already regulations in france preventing insurance from covering ransom payments anyway. even if u pay there's no guarantee they'll give u the key, focus on restoring from backup.

So sorry to hear this, I understand you're in a huge panic right now, but try to stay calm. Having weekly offline backups is your biggest saving grace. Once you go through the legal steps by the book, you should be able to resume operations in a controlled manner within a few days.

I'm curious too.

there are three things to check when doing this. mistakes made on the what to do cybercrie side are usually reversible but expensive.

if you post the result here, it will help others too.

I think it's hard to be that definitive about what to do cybercrime. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Correct me if I'm wrong.

yes, thaats exactly how it is with what to do cybercrime but most time waste accumulates in tasks waiting for approval.

just leaving this note, it might be useful.

There's a trap here, let me mention it... Payment information changes are never verified through the channel they came from.

If you have questions, write them; I'll answer as best I can.

There are three things to check when doing this. btw if 2FA is on, a stolen password alone is useless.

let me summarize the topic, since several different answers were given. like the real issue isn't the number but what it's based on.

trying to do this alone is the most expensve way... honestly if you have questions write them; I'll answer as best I can.

let me summarize the topic, since several different answers were given and if permission and scope aren't in writing, don't start that test.

taking measures without an inventory leaves doors you havent seen open. i mean if you post the result here it will help others too.

I'll try it. When making decisions, write down the worst-case scenario too, not just the best.

Saved. The real issue isn't the number, but what it's based on.

If 2FA is on, a stolen password alone is useless.