On the day a screen shows a ransom note, or your bookkeeper finds that a payment went to an unknown account, nobody wants to be googling who to call. And if email is affected, you may not even be able to open the last message from your IT provider.
In May 2026 the Centre for Cybersecurity Belgium (CCB) published a "first aid for cyber incidents" document. Among other things, it recommends keeping key contacts and the steps to follow on paper. For a business of ten or twenty people, that fits on one page. Here is what I would put on it, and what to prepare so the page actually works on the day.
1. The first three moves, for everyone
This part is for whoever is sitting in front of the screen, not the manager or the IT person. They should be able to read it in thirty seconds.
- Unplug the network cable and turn off Wi-Fi on the affected device. Do not switch it off: the CCB is clear that shutting down wipes traces that help explain the attack.
- Call the person named on the sheet straight away, even if it is only a suspicion.
- Stop using the device, delete nothing, and warn colleagues so nobody opens the same message.
2. Who decides, and on which channel
Write down two names: the person who coordinates, often the managing director, and the person who handles the technical side, in-house or at your provider. For each, a mobile number that also answers outside office hours, and a stand-in.
Plan a fallback channel too. The CCB advises using something outside your usual tools, such as Signal, Threema or SMS, in case company email or chat is compromised. If someone is reading your email, that is not where you plan the response. A Signal group set up in advance with those few people is enough.
3. Write everything down, with the time
From the first minutes, someone keeps a log: what was seen, what was done, at what time, and by whom. On paper if the PCs are suspect. Keep the messages received, screenshots and bank statements. The log helps the provider investigating, the police, the insurer, and later on, working out what gave way.
Do not reinstall or restart anything until the evidence is secured, unless you really have to. And do not restore a backup taken just before or just after the attack: Safeonweb@work, the CCB's site for organisations, says to check first that the backup system itself was not compromised.
4. Who to notify in Belgium
This is the part people search for most when under pressure. The contacts below come from the CCB and Safeonweb@work pages, checked in October 2026.
- Your bank, and Card Stop on 078 170 170, if money has disappeared, bank details were handed over or a payment went to a fraudster, so fraudulent transactions can be blocked. To prevent it upstream, see how to handle a fake change of supplier IBAN.
- The local police, to file a complaint, especially if money was lost or there is extortion. Bring the log, screenshots and statements.
- The CCB, through the notif.safeonweb.be form or incident@ccb.belgium.be. It is mandatory for entities covered by NIS2 and recommended for everyone else. The CCB's emergency number is reserved for NIS2 incidents.
- The Data Protection Authority (APD/GBA) if personal data is involved: customer files, staff records, a mailbox read by an outsider. See the next point.
- Your insurer, if you have cyber cover. Read now what the policy requires when you make a claim, and put the policy number on the sheet.
- For a suspicious message with no incident behind it: forward it to suspect@safeonweb.be.
5. The APD's 72 hours, and the account to create now
Under the GDPR, the controller must notify the Data Protection Authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to the people concerned. Seventy-two hours, weekends included, while everyone is trying to get the business running again.
One practical detail makes the difference: the APD only accepts notifications through its portal, emailed ones are not processed, and its user manual says you need a company account on that portal. Create it, or check who has access, while things are calm. On the day, part 1 of the form can go out quickly, and the APD then gives you 21 calendar days to complete part 2.
Even if you conclude that you do not need to notify, the GDPR requires you to document the breach in a register (Article 33(5)). The log from step 3 is the basis for it. I am not a lawyer: if you are unsure whether you must notify, ask your legal adviser, or your data protection officer if you have one.
6. The ransom
The CCB strongly advises against paying. It accepts that it is sometimes the only option, but points out that criminals will jump on any chance to extort more. If the question comes up, it is a management decision taken with the insurer and the police, not a reflex in a panic. It comes up far less when an offline copy has been successfully restored recently, as I explained in the post on backups, accounts and updates.
What goes on the page
- The three moves: unplug, do not switch off, call.
- The coordinator, the technical contact and their stand-ins, with mobile numbers.
- The fallback Signal or SMS group.
- Bank, Card Stop 078 170 170, local police, notif.safeonweb.be, insurer and policy number.
- Who has access to the company account on the APD portal.
- Contact details for your domain registrar and your admin accounts, so you can take back control of email (see who really holds your business's keys).
Print it, keep one copy at the office and one at home, and reread it twice a year. If you would like to fill it in with someone who knows your setup, or test a restore while things are quiet, that is exactly the kind of work we do in hour packs: info@z80.be or +32 494 111 041.