Security Incident and Data Breach Report Intake

Thanks for reporting this. The details you share here go directly to the security and compliance team and help us respond quickly. Your responses are completely confidential and anonymized. This takes about 8 minutes — if the incident is still active, please also contact IT/Security through your emergency channel right away.

What is your role in relation to this incident?

• Employee who discovered or experienced it
• IT / Security staff member
• Manager of an affected team
• Third-party vendor or contractor
• Other

When did you first notice or suspect something was wrong? (Best estimate is fine.)

Which best describes the type of incident?

• Phishing or social engineering attempt
• Unauthorized system or account access
• Malware or ransomware
• Lost or stolen device
• Data sent or exposed to the wrong recipient
• Physical break-in or unauthorized access to premises
• Other

As far as you know, what type of data may have been affected? Select all that apply.

• Customer personal information
• Employee personal information
• Financial or payment data
• Health records
• Intellectual property or trade secrets
• Login credentials or passwords
• Other

In your own words, what happened? Include what you saw or were told, and any systems, accounts, or locations involved.

How confident are you that the incident is currently contained (i.e., not actively ongoing)?

Has this incident already been reported to your IT or Security team through another channel?

• Yes, already reported
• No, this is the first report
• In progress / not sure

What actions, if any, have already been taken to contain or address this incident (e.g., password reset, device disconnected, account disabled)?

Reconstruct the actual timeline of this incident: how it was first noticed, exactly what the respondent did in the minutes and hours after, and who else was told or involved. Anchor on the specific incident type and data categories they selected, and probe any gap between discovery and reporting — ask what caused the delay, if any, and whether the respondent believes the incident could still be active. If they seem unsure about scope, ask what evidence would help them confirm it.

How clear was it to you what steps to take when you noticed this incident?

Roughly how many individuals or records do you think may be affected? (Enter 0 if unknown or not applicable.)

Which department or team are you part of?

• IT / Security
• Operations
• Sales / Customer Success
• Finance
• HR
• Other
• Prefer not to say

Thank you for reporting this promptly. Your report has been logged and routed to the security team for immediate review; you may be contacted for follow-up as part of the incident response process.