Incident guide
Website defaced, redirecting or serving malware
Your site shows content you did not publish, sends visitors elsewhere, or is flagged by browsers, search engines or your host.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- The pages were changed or show a message from someone else.
- Visitors are sent to other sites, or browsers and search engines warn about yours.
- Unknown admin users, files or scheduled tasks have appeared.
- Your hosting provider reports malware or abuse from your site.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not delete files or logs before you have copied them.
- Do not restore a backup and go live without closing the way in. The attacker may return.
- Do not reuse the old passwords or keep old keys.
- Do not ignore browser or search engine warnings. Visitors see them before they see your site.
Keep as evidence
- Copies of the files, database and server logs from before you changed anything.
- Screenshots of the defacement, the redirect or the browser warning, with the time.
- A list of files with their modification times, and of admin users that you did not create.
- Notices from your hosting provider or from the service that flagged the site.
Where to report
Anywhere
Your hosting provider
When: Right away.
How: Tell them what you see and ask for the access and error logs for the period. Follow their instructions on isolating the site.
In Turkey
Personal Data Protection Board (KVKK)
When: If personal data may have been reached and you are the data controller.
How: A data controller notifies the Board without delay and within 72 hours at most of learning of the breach. If it is late, the reason for the delay goes into the notification (Board Decision 2019/10).
Siber Güvenlik Başkanlığı (USOM services)
When: When you can, to report the incident or malicious addresses.
How: Use the cyber incident report and malicious link services on siberguvenlik.gov.tr.
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If you want the matter investigated as a crime.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.