How to Report a Cyber Incident: Step-by-Step Guide

The Breach That Nobody Reported — Until It Was Too Late

In 2023, a mid-size healthcare provider in the Midwest discovered suspicious network activity on a Friday afternoon. The IT manager flagged it internally but didn't report it externally. By Monday morning, threat actors had exfiltrated 1.4 million patient records. The FBI later confirmed the data was already for sale on a dark web marketplace. When investigators asked why no one contacted law enforcement sooner, the answer was painfully common: "We didn't know how to report a cyber incident."

That's not an edge case. According to the FBI's Internet Crime Complaint Center (IC3), they received over 880,000 complaints in 2023 alone — and the Bureau estimates the actual number of incidents is far higher because so many go unreported. Every hour you delay reporting costs your organization money, legal exposure, and trust.

This guide walks you through exactly who to contact, what to document, and when to act. Whether you're a small business owner, an IT director, or someone who just clicked something suspicious, knowing how to report a cyber incident is a skill that limits damage and accelerates recovery.

Why Reporting a Cyber Incident Matters More Than You Think

Here's what actually happens when organizations stay silent after a breach: the threat actor moves laterally, exfiltrates more data, and often deploys ransomware as a parting gift. Meanwhile, your legal clock is ticking. Regulatory bodies like the FTC, HHS, and state attorneys general don't look kindly on delayed disclosure.

The Verizon 2024 Data Breach Investigations Report found that 68% of breaches involved a human element — phishing, credential theft, social engineering. That means most incidents start small. A single compromised account. A suspicious email. The earlier you report, the earlier containment begins.

Reporting also helps the broader community. When you file a report with CISA or the FBI IC3, your data feeds into threat intelligence that protects thousands of other organizations. Silence benefits only the attacker.

Step 1: Contain First, Then Report

Before you pick up the phone or open a browser, take immediate containment steps. I've seen organizations rush to report while the attacker was still actively on the network — and the report itself became outdated within hours.

Immediate Containment Actions

Isolate affected systems. Disconnect compromised machines from the network. Don't power them off — forensic evidence lives in volatile memory.
Disable compromised accounts. If credential theft is suspected, force password resets and revoke active sessions immediately.
Preserve logs. Firewall logs, email server logs, endpoint detection logs — save everything. Don't overwrite or "clean up" anything.
Activate your incident response plan. If you don't have one, that's a problem to fix after this is over.

Containment and reporting should happen in parallel, but containment gets priority. A well-contained incident reported two hours later is infinitely better than a spreading breach reported immediately with no context.

Step 2: Report Internally Using a Clear Chain of Command

Your employees need to know exactly who to call. In my experience, the biggest internal reporting failures happen because there's no documented escalation path. Someone notices something strange, mentions it to a coworker, and it dies there.

Build a Reporting Chain That Actually Works

First contact: IT security team or designated incident responder.
Second contact: CISO or IT director.
Third contact: Legal counsel and executive leadership.
Fourth contact: External reporting (law enforcement, regulators, cyber insurance carrier).

Every employee should know step one of that chain. Not just IT staff — everyone. The receptionist who gets a suspicious call. The accountant who receives a spoofed invoice. The intern who clicks a link in a phishing email. Security awareness training makes this instinct, not guesswork. If your team hasn't been through structured training, our cybersecurity awareness training program covers exactly this kind of real-world incident response behavior.

Step 3: Report to the FBI's Internet Crime Complaint Center (IC3)

What Is IC3 and When Should You File?

The FBI IC3 is the primary federal intake point for cyber crime complaints in the United States. You should file a report with IC3 whenever your organization experiences a data breach, ransomware attack, business email compromise, credential theft, or any financially motivated cyber crime.

File your complaint at ic3.gov. The process takes about 20-30 minutes. Here's what you'll need:

Date and time the incident was discovered
Type of incident (ransomware, phishing, BEC, etc.)
How the attack occurred (if known)
Financial losses or demands
IP addresses, email addresses, cryptocurrency wallets, or other indicators of compromise
Any communications from the threat actor

IC3 triages complaints and routes them to the appropriate FBI field office, Secret Service, or other agencies. If your losses exceed $100,000 or involve critical infrastructure, expect direct follow-up. But even smaller incidents matter — they help the FBI identify patterns and disrupt threat actor networks.

Step 4: Report to CISA

The Cybersecurity and Infrastructure Security Agency (CISA) wants to hear from you — especially if the incident involves ransomware, critical infrastructure, or could affect other organizations.

Report incidents through CISA's reporting portal or call their 24/7 hotline at (888) 282-0870. CISA doesn't investigate crimes — that's the FBI's job. Instead, CISA provides technical assistance, shares threat intelligence, and can deploy incident response teams for significant events.

Under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), critical infrastructure entities will soon face mandatory reporting timelines — 72 hours for significant incidents, 24 hours for ransomware payments. Even if your organization isn't covered yet, voluntary reporting sets you up for compliance when final rules take effect.

Step 5: Notify Your State Attorney General and Affected Individuals

Every U.S. state has data breach notification laws, and they vary significantly. Some require notification within 30 days; others give you 60 or 90. Some require notification to the state attorney general before individuals; others are simultaneous.

Key Steps for Regulatory Notification

Identify which states' residents are affected. Each state's law may apply.
Review your state's specific notification requirements at the FTC's state law resource page.
Draft notification letters with legal counsel. Include what happened, what data was exposed, and what steps affected individuals should take.
Contact your cyber insurance carrier — they often have breach response counsel on retainer.

If you handle health data, HIPAA breach notification rules apply and the clock starts ticking fast. Financial institutions have GLBA obligations. The point is: know your regulatory landscape before an incident forces you to learn it under pressure.

What Exactly Should a Cyber Incident Report Include?

Whether you're filing with the FBI, CISA, your insurer, or your board, a strong incident report covers these elements:

Timeline: When was the incident detected? When did it likely begin? What containment actions were taken and when?
Attack vector: Phishing email? Exploited vulnerability? Compromised vendor? Social engineering?
Scope: How many systems, accounts, or records are affected?
Data at risk: PII, financial data, health records, intellectual property?
Threat actor indicators: IP addresses, domains, malware hashes, ransom notes, cryptocurrency addresses.
Business impact: Operational disruption, financial losses, reputational damage.
Response actions: What your team has done so far and what's planned next.

Document everything in writing. Screenshots, log excerpts, email headers — all of it. This documentation becomes the foundation for law enforcement investigation, insurance claims, and regulatory responses.

Common Mistakes That Make Reporting Harder

Wiping Systems Before Preserving Evidence

I've seen IT teams panic and reimage compromised machines before anyone captures forensic data. Once that evidence is gone, it's gone. Always image drives and capture memory dumps before remediation.

Paying Ransomware Demands Without Reporting

The FBI strongly advises against paying ransoms, but I understand the business pressure. What makes it worse is paying without reporting. You could violate OFAC sanctions if the threat actor is on a sanctioned entity list, and you lose the chance for law enforcement to potentially provide decryption assistance.

Waiting for "Certainty" Before Reporting

You don't need a complete forensic analysis to file a report. IC3 and CISA both accept preliminary reports. You can update them later. Waiting for perfect information means losing critical response time.

Forgetting Multi-Factor Authentication Post-Incident

After an incident involving credential theft, organizations often reset passwords but don't implement or enforce multi-factor authentication. That's how the same threat actor walks right back in weeks later under a zero trust model, every access request should be verified regardless of network location.

How to Prepare Your Organization Before an Incident Happens

The organizations that report incidents quickly and effectively are the ones that practiced before it mattered. Here's what separates them:

Written incident response plan that includes internal and external reporting procedures, contact information, and role assignments.
Tabletop exercises run at least annually. Walk through a ransomware scenario, a BEC scenario, and a data exfiltration scenario.
Phishing simulations that train employees to recognize and report suspicious messages. Our phishing awareness training for organizations runs realistic simulations and tracks who reports, who clicks, and who ignores — so you can target your training where it matters most.
Pre-established relationships with your local FBI field office and CISA regional representative. Don't make your first call during a crisis.
Cyber insurance with a clear understanding of your policy's reporting requirements and timelines.

Reporting Isn't Optional — It's Operational

Knowing how to report a cyber incident isn't a compliance checkbox. It's an operational capability that directly affects how fast you recover, how much you lose, and whether the threat actor hits someone else next.

The steps are straightforward: contain, document, report internally, report to IC3 and CISA, notify regulators and affected individuals, and keep updating as you learn more. None of this is complicated in theory. It's brutal in practice — unless you've prepared.

Start by training your people. Most incidents begin with a human mistake, and most delayed reports happen because that human didn't know what to do next. Build the muscle memory now, when the stakes are low. Because when a real incident hits, you won't rise to the occasion — you'll fall to the level of your preparation.