⛑Emergencies

Now, in this order:

1. Switch off the account. Do not change the password — switch it off. That also ends running sessions.
2. Change passwords the same person has used elsewhere: mailbox, domain management, all services.
3. Check what has happened. Look at the access log: when, what, from where.
4. Check the mailbox — have forwarding rules been set up? That is the typical attack: an attacker creates a rule that sends copies of all mails elsewhere, and it survives every password change.
5. Document and assess whether there is a duty to report.

Afterwards: introduce a password manager and activate two-factor sign-in everywhere it is available.

Now:

1. Change the password of the affected service immediately — from a different device.
2. Do the same for all services with the same password.
3. Check forwarding rules in the mailbox.
4. Warn colleagues. Phishing rarely comes alone; if one person received it, others have too.
5. If payment data is involved: inform the bank, block the card.

Do not: tell the person off. Whoever reports it has done the right thing, and whoever gets into trouble the first time will not report it the second time.

And the prevention that actually works: two-factor sign-in. An intercepted password on its own is then of no use to the attacker.

Now:

1. Lock or wipe it remotely, if that has been set up.
2. Change passwords for everything signed in on the device — mailbox, CRM, cloud storage.
3. Switch off accounts if you are not sure what had been signed in on it.
4. Assess: did it hold personal data? A laptop with a customer list is an incident that must be reported if it had no encryption.
5. Report it to the police, if stolen.

The decisive point is number 4: had the hard drive been encrypted? If so, the incident usually has no consequences. If not, it is a data breach.

That is the preparation that defuses this case, and it costs twenty minutes once per device.

Now:

1. Pause the campaign. Immediately, before you do anything else. What has not gone out yet will then not go out.
2. Establish how many have already gone out and to whom.
3. Decide whether a correction is needed. For a wrong price: yes. For a mail to the wrong group: usually not — a second mail makes it worse.
4. Be prepared for reactions. Anyone who gets in touch gets an honest, short answer.
5. Document what happened and why.

What you cannot do: call the mails back. What is out is out.

Afterwards: check how it could happen. In most cases a filter had not been set or an audience was empty — and for the latter there is the safety brake.

First the question: how bad is it?

• Typo, wrong name: do nothing. A correction draws more attention than the mistake.
• Wrong price, wrong date, wrong commitment: correct it — briefly, factually, without a long explanation. “Yesterday’s letter contained an incorrect price. The correct price is …”
• Legally sensitive content — false advertising claim, missing mandatory notice: correct it and get legal advice.
• Personal data sent to the wrong people: that is a data breach with its own duty to assess.

If the campaign is still running: pause it, correct the template, then resume. The rest get the correct version.

And a wrong price can be construed as a binding offer — so a quick correction here is not just a courtesy.

Now:

1. Do nothing further. No repair attempts, no re-creation. Every change makes restoring harder.
2. Establish exactly what is gone. One contact, one campaign, a whole area?
3. Look at the access log: who, when, what.
4. Report it — stating what was deleted and roughly when.

What is possible depends on the case:

• A single record: sometimes it has only been archived, not deleted. Check first.
• Larger losses: a backup can be restored — but that brings back the entire state from that time, and everything that has happened since is lost.

That is why: restoring is an intervention, not an undo button.

Now:

1. Check whether it is on your side. Another device, another network (phone as a hotspot), another browser.
2. Open the system status, if it can be reached. It often says which service is affected.
3. Report it — with the exact error message, not with “it doesn’t work”.
4. Carry on working on paper. Add notes later; a note on a slip of paper is better than none.

What you should have prepared, so that an outage does not disrupt your business:

• The most important phone numbers available outside the system too.
• Who is informed in an emergency.
• An idea of how long you can manage without it.

No provider in the world guarantees a hundred percent. The question is not whether an outage will come, but what it costs.

Now:

1. Check whether it really is the licence. The message says so; so does the system status.
2. Reach the operator. This is a case only they can resolve.
3. Stay calm: your data is there. An expired licence blocks access; it does not delete anything.

What you should change afterwards:

• Expiry date in the calendar, with a month’s notice.
• Two people know the contact person at the operator, not just one.
• Check invoices to see whether a renewal is outstanding.

There is a grace period in case the licence sync cannot get through for technical reasons. It does not help if the licence really has expired.

The case that does the most damage and is least often prepared for.

Now:

1. Switch off the account, if the departure is final.
2. Review and redistribute that person’s open follow-ups and tasks.
3. Check running campaigns: who answers the replies now?
4. Clarify third-party login details: domain, mailbox, service providers. This is the point where it gets expensive.
5. Look through contacts for whom she was the only contact person.

What this means for the future: anything only one person knows is a risk. Two administrators, documented accounts, notes in the system instead of in someone’s head — those are the three things that defuse this case.

This is the most serious case in this list. Now:

1. Disconnect affected devices from the network. Do not switch them off — disconnect them. Switching off can destroy traces.
2. Do not pay, at least not as a first reaction.
3. Report it to the police. The police have specialised units for this.
4. Supervisory authority: if personal data is affected, the 72-hour deadline is running.
5. Get expert help. This is not a case for your own IT person on the side.
6. Check backups — separately from the affected network. A backup that was connected to the same network is often encrypted too.

How bad it gets is decided beforehand: separate backups, two-factor sign-in, up-to-date systems, and people who report a strange mail instead of opening it.

One page, printed out, in a place you can reach without a computer:

• Who can be reached in an emergency — operator, IT, data protection, management. With phone numbers.
• Where which data is kept and who has access.
• Where the login details are for domain, mailbox, services — in the password manager, with at least two authorised people.
• The 72-hour rule, so that someone knows it if the worst comes to the worst.
• What happens in an outage: how do we carry on working, whom do we inform.

That is the entire emergency plan for a small business. One page, reviewed once a year.

And the most effective single measure of all: two-factor sign-in everywhere it is available. It prevents the most common incident.

By this separation:

You can solve it yourself: - Something is not visible (filter, period, role). - A mail did not arrive (spam folder, address). - Something looks wrong (cache, hard reload). - Someone cannot get in (reset the password).

A case for the operator: - Nothing works any more, from several devices. - An English, technical error message. - Data is missing that nobody deleted. - Suspicion of an attack or data leak. - Something reproducibly does not work as it should.

If in doubt, report it. One report too many costs five minutes; one too few can mean that an error goes unnoticed for weeks.

The part most often skipped, and the only one that prevents it from happening again.

1. Write down what happened. What happened, when you noticed it, what you did, how long it took to fix.
2. Look for causes, not culprits. Whoever looks for culprits will not get a report next time.
3. Change one thing. Not ten — one that makes the case impossible or less likely.
4. Discuss it in the team. Briefly, without names, with what everyone should take away from it.
5. Check in three months whether the change still applies.

Point 3 is the decisive one. An incident that leads to twelve measures leads to none being implemented. One that leads to one changes something.