Incident in progress? If you hold a policy with us, call the 24/7 incident hotline now: +27 61 043 5137. Early notification protects your recovery options and your cover.

Call us first

Before you contact attackers, wipe machines or start rebuilding, call the incident hotline on your policy schedule. Specialists can guide containment and preserve the evidence your claim and investigation will need. [TODO: confirm hotline hours and response arrangements].

Contain, don't destroy

  • Disconnect affected devices from the network (pull the cable or disable Wi-Fi). Don't switch them off unless advised, as memory can hold vital evidence.
  • Disable compromised accounts and reset passwords from a clean device. Revoke active sessions in your email and cloud platforms.
  • If backups are online, isolate them immediately.
  • Don't delete ransom notes, suspicious emails or logs. Take screenshots and keep everything.

Don't engage the attackers

Don't reply to ransom notes or extortion emails, and don't pay anything. Contact can escalate the situation and limit your options. Any engagement should be handled by specialist negotiators, with the insurer's prior consent.

If money was sent to a fraudster

Speed matters. Contact your bank's fraud line immediately and ask it to attempt a recall of the payment. Then open a case with the South African Police Service (SAPS) and keep the case number. Notify us as well.

Personal information and POPIA

If personal information may have been accessed or acquired by an unauthorised person, POPIA (section 22) requires you to notify the Information Regulator and the affected data subjects as soon as reasonably possible. Breach counsel will help you assess what happened and what must be notified, and when. Don't send notifications before taking advice. They need to be accurate.

Communicate carefully

  • Use a separate, clean channel (e.g. phones or personal email) if you suspect your email is compromised.
  • Keep internal communication need-to-know and factual. Avoid speculation in writing.
  • Agree on external statements with the response team before speaking to clients, media or social media.

Keep a record

Start a simple log: what was noticed, when, by whom, and every action taken since. It speeds up the investigation and supports your claim.

A printable checklist

  1. Call the 24/7 incident hotline: +27 61 043 5137
  2. Isolate affected systems; keep them powered on unless told otherwise
  3. Disable compromised accounts; reset credentials from a clean device
  4. Protect backups; disconnect them if online
  5. Preserve evidence: ransom notes, emails, logs, screenshots
  6. Don't contact attackers or pay anything
  7. Payment fraud? Call your bank's fraud line now, then SAPS
  8. Personal information involved? Take breach legal advice on POPIA notification
  9. Keep a timeline of everything
This guide is general information and not legal or technical advice for your specific situation. Follow the instructions of the appointed incident response team.