Response Red — Victim Advisories

Clear head, cold blood: managing panic during a cyber incident

Bob Vasic — Thu, 23 Jul 2026 08:00:00 GMT

Cyber incidents are psychological events before they are technical ones. Attackers weaponize urgency — deliberate calm is a countermeasure, and it can be practiced.

The essentials:

Urgency is a weapon: countdowns, deadlines, and threats exist to force unforced errors.
The acute stress response passes within minutes if you let it — make no irreversible decision inside it.
Write, don't remember: a shared incident log offloads working memory and measurably reduces anxiety.
One incident lead and a fixed decision rhythm prevent more early damage than any technical control.
No blame during the incident: fear of punishment hides the facts responders need most.

Read the full advisory on responsered.com

Do we have to tell anyone? Breach notification in plain language

Bob Vasic — Thu, 16 Jul 2026 08:00:00 GMT

Regulators, customers, partners — after a breach, who must hear about it, and by when? The clocks start earlier than most teams think, and the decision needs a written trail either way.

The essentials:

Clocks generally start at awareness of a likely breach — not at full understanding. GDPR's 72-hour supervisory notice is the famous one; it is not alone.
Duties stack in layers: data-protection regulators, affected individuals, contracts with customers and partners, and sector rules (finance, health, critical infrastructure) — each with its own trigger and deadline.
Not every incident is notifiable — most regimes are risk-based. But the assessment must be done, and documented, even when the conclusion is "no".
Facts from forensics feed the decision; counsel makes it. Neither works alone.
Over-notification has real costs too — panic, churn, legal exposure — which is why precision of scope matters in both directions.

Read the full advisory on responsered.com

Your first cyber insurance claim: keep the coverage you paid for

Bob Vasic — Thu, 25 Jun 2026 08:00:00 GMT

The incident is real and the policy exists for exactly this. Between here and a paid claim sit notice deadlines, panel rules, and a documentation trail — start all three now.

The essentials:

Notify the insurer immediately — late notice is among the most common reasons cyber claims are reduced or denied.
Many policies require approved ("panel") vendors for response and forensics; hiring your own first can leave those costs uncovered.
Document from hour zero: costs, hours, decisions, and business impact. Claims are paid on evidence, not narrative.
Do not admit liability, settle with third parties, or authorize extortion payments without insurer involvement — each can void parts of coverage.
Read the policy tonight with counsel: sublimits, exclusions, and waiting periods shape response strategy more than most teams expect.

Read the full advisory on responsered.com

Preserving digital evidence: what to save before responders arrive

Bob Vasic — Thu, 18 Jun 2026 08:00:00 GMT

In the gap between discovering an incident and professional response, evidence either survives or it doesn't. You don't need forensic tools — you need to stop destruction.

The essentials:

The best preservation is not touching things: isolate affected systems, then leave them alone.
Memory disappears at power-off, and logs silently overwrite themselves within days or even hours — these two losses are permanent.
Phone photos of screens, with timestamps, are legitimate and genuinely useful evidence.
Never work on the evidence: no antivirus scans, cleanups, updates, or casual logins on affected machines.
A handwritten timeline made today beats a reconstructed one made next week.

Read the full advisory on responsered.com

Sextortion: they have intimate images and are demanding money

Bob Vasic — Thu, 04 Jun 2026 08:00:00 GMT

Someone you trusted online is threatening to send private images to your family and followers unless you pay. Do not pay — payment escalates. There is a path through this, and you are not walking it alone.

The essentials:

Do not pay. Payment marks you as someone who pays — demands escalate and continue; refusal, statistically, is what makes them move on.
Stop responding, but do not delete the conversation — it is the evidence for every takedown and report that follows.
Hash-blocking services (StopNCII for adults; NCMEC's Take It Down for anyone under 18) can prevent images from being posted on major platforms without you ever sharing the images themselves.
This is industrialized crime run from scripts against thousands of targets at once — nothing about it is personal, and the operator's only lever is your silence.
If the target is a minor: a trusted adult and an immediate report (NCMEC / local police). The law protects the victim, and there is no trouble waiting for them — only help.

Read the full advisory on responsered.com

Suspected insider data theft: investigate quietly, act correctly

Bob Vasic — Thu, 28 May 2026 08:00:00 GMT

When the threat has a badge and a login, the first days decide the case. Mishandled, they destroy the evidence, the legal position, and sometimes an innocent career.

The essentials:

Keep the circle tiny: legal, HR, one executive, and security — strictly need-to-know.
Do not confront or suspend on suspicion alone; tipping off the person triggers evidence destruction, and employment law shapes every available move.
Preserve, don't inspect: opening files and mailboxes yourself alters timestamps a legal case may depend on.
Coordinate every access change with counsel — a wrong move creates wrongful-dismissal exposure on top of the data loss.
Typical signals: mass downloads, activity at odd hours, personal cloud or USB transfers, and spikes shortly before a resignation.

Read the full advisory on responsered.com

Wrong recipient, public bucket: when the leak was an accident

Bob Vasic — Thu, 14 May 2026 08:00:00 GMT

A spreadsheet to the wrong client, a storage bucket open to the internet. No attacker, real exposure — and the clock does not care that it was a mistake.

The essentials:

Assume delivered and seen: email recall functions rarely work outside your own organization.
Contain first — close the bucket, expire the link, restrict the file — then scope precisely: whose data, which fields, how long exposed.
For misdirected email, a prompt, polite deletion request with written confirmation is standard practice and genuinely effective.
Accidental exposure can be a notifiable breach; the analysis is the same as for an attack, and "it was a mistake" is not an exemption.
Access logs decide severity for open buckets: exposed-but-never-accessed is a different incident from crawled-and-downloaded.

Read the full advisory on responsered.com

Scammed online: your first moves after financial fraud

Bob Vasic — Thu, 07 May 2026 08:00:00 GMT

Investment platforms that vanish, "support" that drains accounts, a relationship that turned into transfers. Recovery depends on speed and evidence — not confrontation.

The essentials:

Stop all further payments immediately — including "release fees", "taxes", or "verification deposits" to withdraw your money. Those are the same scam continuing.
Call your bank or card issuer about recalls and chargebacks the same day; for crypto, record transaction hashes and report — tracing is possible, reversal is rare.
Do not confront the scammer or reveal that you know. Silence preserves accounts and evidence.
Anyone who contacts you offering to recover your lost money is almost always a second scam.
Capture everything now — profiles, chats, and platforms are deleted overnight.

Read the full advisory on responsered.com

The CEO on the call wasn't the CEO: deepfake voice and video fraud

Bob Vasic — Thu, 23 Apr 2026 08:00:00 GMT

A live call, the right face, the right voice, an urgent confidential transfer. Cloned audio and video now survive real-time conversation — process is the only reliable defense.

The essentials:

Minutes of public audio or video are enough to clone an executive convincingly — including live, interactive calls.
The tell is never the face or the voice; it is the pattern: urgency, secrecy, and authority pushing a payment or credential action outside normal process.
Verification means an independent channel you initiate — a callback to a number you already hold, or a pre-agreed code word. "It sounded exactly like her" is not verification.
Report attempts even when they fail; finance and security teams need to know the campaign is running.
Defenses that scale are procedural: callback rules and dual approval for payments above a threshold, with no executive exception.

Read the full advisory on responsered.com

Company network breach: contain it without destroying the evidence

Bob Vasic — Thu, 16 Apr 2026 08:00:00 GMT

An attacker is — or was — inside your network. Your next moves either preserve the ability to answer "what did they take?" or erase it permanently.

The essentials:

Containment and evidence preservation are one decision, not two: isolate systems, don't wipe them.
Rebuilding a compromised server before it is imaged destroys the record your insurer, regulator, and lawyers will ask for.
Move incident communications out of band immediately — assume the attacker reads your email and chat.
Scope before eviction: blocking indicators one at a time teaches the attacker to dig deeper footholds.
Start an incident log now — times, observations, actions, and who decided what.

Read the full advisory on responsered.com

Payroll diversion: the "employee" who changed their bank details wasn't

Bob Vasic — Thu, 09 Apr 2026 08:00:00 GMT

HR processed a routine direct-deposit change, and salary went to a criminal's account. It is business email compromise aimed at payroll — and it responds to the same clock.

The essentials:

The request came from a spoofed lookalike address or the employee's genuinely compromised mailbox — determine which, because the second means a live intrusion.
Bank recall is a race measured in hours, exactly like wire fraud: call the moment the diversion is discovered.
Search for other pending or recent detail changes now — these campaigns hit many employees at once.
Verify every change with the employee by phone or in person, never by replying to the requesting email.
The lasting fix is procedural: out-of-band verification for every banking change, no exceptions for urgency.

Read the full advisory on responsered.com

Your vendor was breached: assume nothing, rotate everything they held

Bob Vasic — Thu, 02 Apr 2026 08:00:00 GMT

The email says your provider "detected unauthorized access". Their incident just became your exposure — measured by what they could reach and what they stored.

The essentials:

Your exposure equals the vendor's access plus the vendor's storage: credentials, API keys, network paths, and your data on their systems.
Rotate every credential and key the vendor held or could see — now, without waiting for their final forensics report.
An MSP or IT provider with admin access is the maximum-severity case: treat it as potential direct compromise of your own environment.
Ask the vendor pointed written questions; their first notice is usually vague by design.
Expect phishing that impersonates the breached vendor within days — attackers ride the news.

Read the full advisory on responsered.com

Identity theft: contain the damage, step by step

Bob Vasic — Thu, 26 Mar 2026 08:00:00 GMT

Accounts you didn't open, charges you didn't make, a login that no longer accepts your password. Work account by account, in the right order, and write everything down.

The essentials:

Secure your email account first — it is the master key that resets everything else.
Freeze your credit with the bureaus (in the US: Equifax, Experian, TransUnion — free). A freeze blocks new accounts; a fraud alert only asks lenders to be careful.
Move your most important accounts to unique passwords and app-based two-factor or passkeys: email, banking, and your phone carrier first.
Ask your mobile carrier for a SIM-swap / port-out lock — hijacking your number defeats SMS codes.
Keep a dated log of every discovery, call, and case number. It becomes your dispute file.

Read the full advisory on responsered.com

Your company appeared on a leak site: verify before you react

Bob Vasic — Thu, 19 Mar 2026 08:00:00 GMT

A ransomware crew's blog lists your name, a countdown, and "proof" samples. What happens next should be driven by verification and law — not by the countdown.

The essentials:

Verify first: leak-site "proof" is sometimes recycled from old breaches, inflated, or another company's data entirely.
Capture the listing and samples immediately — postings change and vanish, and you will need the record.
The posting itself starts clocks: regulators, contracts, and insurers may all have notice requirements regardless of what you pay or say.
Paying for "deletion" buys a promise from criminals; there is no verification, and copies routinely survive.
If the data is real, the intrusion that took it may still be live — scoping the source breach comes with the response.

Read the full advisory on responsered.com

Microsoft 365 or Google Workspace compromised: evict them from the tenant

Bob Vasic — Thu, 12 Mar 2026 08:00:00 GMT

An attacker is inside your productivity cloud — mail, files, identities. Password resets alone do not evict them; tokens, app grants, and rules do the persisting.

The essentials:

Identity is the perimeter: revoke sessions and refresh tokens for affected accounts tenant-wide — a password change without revocation leaves the attacker logged in.
Persistence hides in four places: OAuth app grants, inbox rules and forwarding, new or elevated admin accounts, and changed federation or authentication settings. Check all four.
Export the audit logs now; default retention is short and the investigation depends on them.
Common entry: MFA-fatigue prompts, phished session tokens, and legacy protocols that bypass MFA entirely.
Scope what was read — mailboxes, files, sharing links — before declaring the incident closed; legal duties ride on that answer.

Read the full advisory on responsered.com

Business email compromise: the first 24 hours after wire fraud

Bob Vasic — Thu, 05 Mar 2026 08:00:00 GMT

A payment went to a criminal account after an email that looked exactly right. Funds can sometimes be frozen — but the window is measured in hours, not days.

The essentials:

Call your bank's fraud line immediately and request a recall; ask them to alert the receiving bank. Every hour matters.
Report to law enforcement the same day — rapid-response programs (such as IC3's Recovery Asset Team in the US) can freeze funds, with the best odds inside 24–72 hours.
Do not delete the fraudulent emails. Their full headers prove how the fraud was routed.
Assume the mailbox is still compromised: check rules, forwarding, and connected apps before trusting it again.
Verify any "corrected" bank details by phone, using a number you already had on file — never one from the email.

Read the full advisory on responsered.com

Crypto wallet drained: trace it, report it, stop the bleeding

Bob Vasic — Thu, 26 Feb 2026 08:00:00 GMT

The balance is gone in transactions you never signed — or one you did sign, without understanding what it approved. Reversal is rare; tracing and freezing are not hopeless.

The essentials:

Move whatever remains to a brand-new wallet — new seed phrase, created on a clean device — before anything else.
Record every transaction hash and destination address now; on-chain tracing is real, and exchanges can freeze funds that land with them.
Work out the how: a leaked seed phrase, a malicious token approval you signed, or malware on the device — each has a different cleanup.
Report to the exchanges on the fund path and to law enforcement with the hashes; speed improves the freeze odds.
Every "fund recovery expert" who contacts you or advertises to victims is a second scam.

Read the full advisory on responsered.com

Website defaced: restore it without erasing the way they got in

Bob Vasic — Thu, 19 Feb 2026 08:00:00 GMT

Your homepage is showing someone else's message. The defacement is the visible symptom — the access that made it possible is the actual incident.

The essentials:

Defacement is proof of write access to your site; the real question is what else that access reached — databases, customer data, other sites on the host.
Capture the defaced state and preserve server logs before any restore; the logs identify the entry point.
Entry is usually an unpatched CMS or plugin, stolen admin credentials, or a weak hosting account.
Restoring from backup without closing the hole invites re-defacement within days — often automated.
Check for webshells and new admin users; attackers leave doors behind the graffiti.

Read the full advisory on responsered.com

Ransomware attack: what to do in the first hour

Bob Vasic — Thu, 12 Feb 2026 08:00:00 GMT

Screens are locked and a ransom note is on your systems. What you do in the first hour decides how much you recover — and how much evidence survives.

The essentials:

Disconnect affected machines from the network — but do not power them off. Memory can hold attacker artifacts and, in some cases, encryption keys.
Protect your backups before anything else. Attackers hunt backups during the attack, not after it.
Do not pay, reply to, or negotiate with the attackers before a professional assessment.
Do not wipe, rebuild, or restore onto affected systems — you may overwrite the only evidence of what was taken.
Photograph every ransom note and record the exact time you found it.

Read the full advisory on responsered.com

DDoS attack: your site is down and the traffic keeps coming

Bob Vasic — Thu, 05 Feb 2026 08:00:00 GMT

The site is unreachable, monitoring is red, and traffic graphs are vertical. Mitigation lives upstream — and sometimes the flood is cover for something quieter.

The essentials:

Volumetric attacks are absorbed upstream — your hosting provider, CDN, or a DDoS-protection service — not by rebooting your servers.
If an extortion email arrived with the flood ("pay or it continues"), do not pay; payment reliably invites the next demand.
Watch authentication and admin logs during the noise — DDoS is sometimes a smokescreen for intrusion attempts.
Honest status updates to customers beat silence; outages are forgiven, stonewalling is not.
Capture traffic graphs and provider tickets as you go; they are the incident record and the insurance evidence.

Read the full advisory on responsered.com

Stolen laptop: from lost hardware to data exposure, and back

Bob Vasic — Thu, 29 Jan 2026 08:00:00 GMT

A laptop is gone — car, café, airport. Whether this is a hardware receipt or a data breach depends mostly on one fact: was the disk encrypted?

The essentials:

Full-disk encryption with a decent password turns a stolen laptop into a brick with resale value — establish encryption status first, everything else follows from it.
Trigger remote lock or wipe through your device management as soon as possible; it takes effect whenever the machine next comes online.
Rotate credentials and revoke sessions for accounts that were signed in — cached sessions can outlive the password that created them.
File the police report with the serial number; insurers and some recoveries depend on it.
An unencrypted disk with personal data on it is a notifiable-breach analysis, not just a loss.

Read the full advisory on responsered.com

Malware on a work device: the alert fired — now what

Bob Vasic — Thu, 22 Jan 2026 08:00:00 GMT

The antivirus flagged something, or the machine started behaving strangely. What you do next either hands responders a clean picture or smears it.

The essentials:

Disconnect from the network but leave the machine powered on — the standing rule for preserving evidence.
Report to IT before attempting any cleanup; "I removed it myself" usually means the evidence is gone and the persistence is not.
An antivirus "threat removed" message is not an all-clear — loaders drop payloads that the first detection may have missed.
Every credential typed on that device recently should be treated as potentially captured.
Write down what you saw and when: the popup, the slowdown, the file you opened.

Read the full advisory on responsered.com

SIM-swap attack: your phone number was just stolen

Bob Vasic — Thu, 15 Jan 2026 08:00:00 GMT

Your phone drops to "No service" and password-reset emails start arriving. Someone convinced your carrier to move your number — and every SMS code now goes to them.

The essentials:

Sudden, unexplained loss of service plus reset emails is the signature — act in minutes, from another device.
Call the carrier's fraud line first and demand the number back and a freeze on further changes.
Until the number returns, every SMS code protects the attacker, not you — switch critical accounts to app-based MFA from a safe device.
Banking and crypto are the usual objective; alert your bank before the attacker gets there.
A port-out PIN or number-lock at the carrier prevents a repeat; SMS-based 2FA on critical accounts is the vulnerability that made this profitable.

Read the full advisory on responsered.com

Your social account is hijacked and messaging your followers

Bob Vasic — Thu, 08 Jan 2026 08:00:00 GMT

You are locked out, the profile is posting crypto scams, and your followers are getting DMs "from you". Recovery and damage control have to run in parallel.

The essentials:

Start the platform's official recovery flow immediately — hijackers change recovery details fast, and the trail cools within hours.
Check the email account behind the profile first; it is the usual way in, and if it's compromised, recovery loops back to the attacker.
Warn your followers from any other channel you have — the hijacker's real target is usually them, not you.
For business profiles, check the ad account and stored payment methods; fraudulent ad spend is a common cash-out.
"Account recovery experts" advertising in replies and DMs are a second scam.

Read the full advisory on responsered.com

Your password showed up in a breach dump: what it really means

Bob Vasic — Tue, 30 Dec 2025 08:00:00 GMT

A monitoring alert says your email and password are circulating. The danger is not the site that leaked — it is every other account where you reused that password.

The essentials:

The breached site is the smallest problem; credential-stuffing bots try that password against hundreds of other services within hours of a dump circulating.
Change the password everywhere it was reused — not just where it leaked. Reuse is the entire attack surface.
This is the moment to adopt a password manager: unique passwords end this class of problem permanently.
MFA on email, banking, and work accounts blunts stuffing attacks even where reuse existed.
Expect targeted phishing that quotes the leaked data to look credible.

Read the full advisory on responsered.com

After the fake support call: they had remote control of your computer

Bob Vasic — Thu, 18 Dec 2025 08:00:00 GMT

A "Microsoft technician" or "bank fraud team" walked you into installing remote-access software. Everything on that machine — and every account it touched — now needs a reset.

The essentials:

Assume everything on the device was visible: saved passwords, banking sessions, files, email.
Disconnect the machine now and do your banking from a different device until this one is professionally cleaned.
Call your bank on the number on your card — especially if any payment, "refund", or screen-share of your account happened.
The "accidental over-refund" they beg you to return is the core of the scam — it is your own money moved between your accounts.
Your number is now on a victim list; expect polished follow-up calls, including from the "refund department".

Read the full advisory on responsered.com

"We recorded you": extortion emails, and how to tell bluff from breach

Bob Vasic — Thu, 11 Dec 2025 08:00:00 GMT

An email claims they hacked your webcam, shows you a real password, and demands cryptocurrency. Almost always it is a mass-mailed bluff — here is how to check, and what to do either way.

The essentials:

These emails are sent in the millions. The password they show is nearly always from an old, public data breach — not from your device.
The convincing detail — your real password on screen — is the entire trick. It proves a website leaked years ago, nothing more.
Never pay and never reply; either marks your address as live and paying.
If the quoted password is still in use anywhere, change it there today and enable MFA.
Treat it as potentially real only if it shows something genuinely current: a recent password, actual file names, or real screenshots.

Read the full advisory on responsered.com

I clicked a phishing link: what actually happens now

Bob Vasic — Thu, 04 Dec 2025 08:00:00 GMT

You clicked, maybe you typed a password — and now your stomach is in your shoes. What matters is the next ten minutes, not the last ten seconds.

The essentials:

Clicking alone is rarely a compromise; entering credentials or running a download usually is. Be precise about which happened.
Change the exposed password now, from a different device, and revoke active sessions — attackers use stolen credentials within minutes, not days.
Report it to IT or security immediately. Speed is the single biggest factor in how small this stays.
Multi-factor authentication helps but does not make you safe: real-time phishing kits relay codes as you type them.
Write down exactly what you saw, clicked, and entered — that detail directs the whole response.

Read the full advisory on responsered.com