MSRXMSRXSecurity
What to do, in order

Incident playbooks

Something has gone wrong. Pick the closest match and follow the steps. Written for people with no security team.

My website was hacked

Defaced pages, strange redirects, spam links, a Google “this site may be hacked” warning, or unknown admin users.

I leaked an API key or password

A key, token or password was committed to git, pasted in a chat or ticket, or shown in a screenshot.

I clicked a phishing link

You entered a password on a fake page, opened a malicious attachment, or approved a login you did not start.

Ransomware: the first hour

Files are encrypted, there is a ransom note, or several machines suddenly cannot open documents.

UPI or bank fraud: money already sent

You approved a collect request, paid a fake QR, shared an OTP, or money left your account without your consent.

A work device was lost or stolen

A laptop or phone with company data, saved logins or VPN access is gone.

In India, also see the India pack: CERT-In reporting, the 1930 helpline and DPDP duties.