Acute emergency or imminent danger? Police emergency number 110  ·  BSI citizen hotline 0800 274 1000
All contact details without guarantee – in case of doubt, the official source applies. V223
Cyberruf Logo CYBERRUF Hotline for cyber incidents
Hotline for cyber incidents

Cyberattack? The right contact, now.

Whether phishing, ransomware, hacked accounts or a data breach: Cyberruf guides you to the right reporting point in your federal state within seconds.

Choose federal state Who reports what?
Central cyber hotline available soon 0800 0xxxxx Currently being set up; in future it will route you directly to the right body. In an acute emergency, please call 110.
16 federal states 110 in an emergency 24/7 emergency availability
Cyberruf – two people with headsets, cybersecurity shield
Three steps to help

Stay calm. Report correctly. Limit the damage.

In a cyber incident, every minute counts. Follow these steps – find the right body via your federal state.

01

Secure & disconnect

Disconnect affected devices from the network, but do not switch them off. Preserve evidence: capture screenshots, emails, log files and timestamps.

02

Choose federal state

Select your federal state on the map. You'll get the responsible Zentrale Ansprechstelle Cybercrime (ZAC) as well as the routes for private individuals.

03

Get in touch

Report the incident by phone or email. In case of acute danger, always call emergency number 110 first.

Checklist: measures after a cyberattack

Based on the BSI's TOP 12 measures for cyberattacks – intended for IT managers and administrators, especially in small and medium-sized enterprises. More from the BSI ↗

Handling a cyberattack is always individual: measures must fit the specific IT environment, the type of attack and the organisation's goals. The following points are meant as guidance and orientation – not a rigid sequence.

  1. Assess the situation: is it really an attack or just a technical fault? Make an initial evaluation.
  2. Continuously coordinate, document and communicate measures to everyone involved and responsible.
  3. Preserve evidence forensically: secure log data, records, notes, photos of screen contents and affected storage media.
  4. Keep the time-critical, especially worth-protecting business processes in view throughout.
  5. Disconnect affected systems from the network.
  6. Cut the internet connections of the affected systems.
  7. Consistently block unauthorised access.
  8. Stop running backups and protect them from further changes.
  9. Determine the extent of the spread and identify all affected systems.
  10. Specifically close the exploited vulnerabilities in systems and processes.
  11. After internal coordination, inform the police and relevant authorities (e.g. data protection, reporting obligations).
  12. Secure access (new passwords, two-factor authentication), keep monitoring the network for anomalies, and restore systems/data only once cleaned.
Reporting points by federal state

Click on your federal state

The responsible state is the one where your company is based or where the incident occurred. Each page contains the official contact channels.

Schleswig-Holstein Hamburg Bremen Niedersachsen Mecklenburg-Vorpommern Brandenburg Berlin Sachsen-Anhalt Nordrhein-Westfalen Sachsen Thüringen Hessen Rheinland-Pfalz Saarland Baden-Württemberg Bayern SH HH HB NI MV BB BE ST NW SN TH HE RP SL BW BY

▸ Tap or click a federal state

Baden-WürttembergBW→BayernBY→BerlinBE→BrandenburgBB→BremenHB→HamburgHH→HessenHE→Mecklenburg-VorpommernMV→NiedersachsenNI→Nordrhein-WestfalenNW→Rheinland-PfalzRP→SaarlandSL→SachsenSN→Sachsen-AnhaltST→Schleswig-HolsteinSH→ThüringenTH→
Orientation

Who reports what – and where?

In Germany there are different contact points for businesses and for private individuals. Cyberruf guides you to the right one.

For businesses & authorities

Zentrale Ansprechstelle Cybercrime (ZAC)

Every federal state operates a ZAC within its State Criminal Police Office – the dedicated contact for businesses, authorities, associations and institutions. It advises preventively and provides fast initial help after an attack.

  • Direct, confidential line to cybercrime specialists
  • Initial assessment and coordination of police steps
  • Reachable by phone and email – contact per federal state

If you have concrete suspicion of espionage or sabotage by foreign intelligence services: Economic Protection of the Federal Office for the Protection of the Constitution (BfV) – Tel. +49 228 99792-3322, wirtschaftsschutz@bfv.bund.de.

For private individuals

Online police station, emergency number & BSI

Private individuals do not contact the ZAC but the police of their state – online via the Onlinewache (online police station) or, in case of acute danger, via the emergency number. The BSI additionally advises on IT security.

  • 110 – police emergency number in case of acute danger
  • Onlinewache of the state police – file a report around the clock
  • BSI citizen hotline 0800 274 1000 – advice & prevention
Free first-aid tool · for businesses

CYBERsicher Notfallhilfe

Official, free online tool from the Transferstelle Cybersicherheit im Mittelstand (funded by the German Federal Ministry for Economic Affairs). Via a self-check, businesses receive initial recommended actions within minutes, suitable public contact points and – if needed – contact with IT service providers.

Go to CYBERsicher Notfallhilfe ↗ More materials & checklists ↗