In short: After a cyberattack, companies can file a report with the police. The right point of contact is the Zentrale Ansprechstellen Cybercrime (ZAC) of the German state criminal police offices, which specialize in companies and authorities. Prepare a short timeline and preserve evidence before systems are rebuilt. This page is general information, not legal advice.
Why a report can make sense
Many companies hesitate to involve the police after an attack. They fear effort, business interruption or publicity. Yet a report has tangible advantages: it documents the incident officially, makes investigations against the perpetrators possible and helps the authorities get an overview of the situation. For insurers, business partners and, where applicable, supervisory authorities, the case number can be a useful proof.
Whether a report is appropriate in an individual case depends on the situation. In cases of extortion, data theft, manipulation of payment data or a break-in to a server with customer data, much speaks in favor. Discuss the question with your legal advisers and, if you have one, your cyber insurer.
The central contact points for cybercrime
The ZAC are specialized police units found in every German federal state, based at the state criminal police offices. They are aimed at companies, authorities and associations. Investigators with a technical background work there who are familiar with attacks on servers, extortion and data theft.
The ZAC of the federal state in which your company has its seat is generally responsible. You will find an overview of all the offices at polizei.de. We deliberately give no phone numbers here, because contact channels can change; use the police's current details.
Look up the contact details of the ZAC in your federal state before anything happens, and enter them in your emergency plan, in a place that is reachable even without working IT.
Cyberattack: preparing a report to the police
You do not have to know everything to file a report. But an orderly presentation of the known state makes the conversation easier. You should gather these points:
- Timeline: when was the incident noticed, by whom, and which steps followed?
- Affected systems: such as web server, shop, customer portal, with location at your own site or at the host.
- Observations: unknown files, unusual log entries, extortion messages, data outflows.
- Damage: outage, affected data, financial consequences, as far as known.
- Measures so far: systems isolated, patched, passwords changed, service providers engaged.
- Contact person: who in the company is available for queries.
For an incident connected with PHP2Shell, the vulnerabilities CVE-2026-109618 and CVE-2026-109619 and the time of your patch belong in the account. A patch does not prove that nothing happened beforehand.
Preserving evidence
For investigations, unaltered traces are decisive. The reflex to delete a compromised server immediately and rebuild it destroys exactly these traces. A better approach is an orderly sequence: isolate the system, preserve logs, file lists and, where applicable, memory and disk images, record checksums, then clean up.
For PHP2Shell, the trade press recommends keeping server logs from 20 October 2026 onward. Also ask your host to preserve the logs if you have no access yourself. How to analyze logs without altering traces is described in Analyzing web server logs after an attack. For a court-admissible preservation, IT forensics is the right route.
After the report, you will generally receive a case number. The investigators get in touch with queries and coordinate with you which data they need, such as copies of logs or memory images. Do not expect investigations to lead to a result quickly; perpetrators are often abroad and use disguised infrastructure. The value of a report therefore does not lie only in the individual case. Findings from many reports help attribute threat groups and disrupt their infrastructure. Record the case number in your incident documentation and pass it on to the insurer or supervisory authority if needed. You can supply new findings from your own investigation later.
Report and other obligations
A report does not replace other notifications. If personal data is affected, a duty to notify the data protection supervisory authority under Art. 33 GDPR may exist, where possible within 72 hours of becoming aware. If your company falls under NIS2, notifications to the BSI are added. And many cyber insurance policies require early notice. Coordinate the order so that no route is forgotten; guidance is under Cyber insurance claim.
You should not consider payments to extortionists without consulting the police, legal advisers and the insurer. The ZAC can advise on such questions.
How does PHP SOS help?
- We preserve logs and system states so that they remain usable for investigations, and document the checksums.
- We prepare a technical timeline and an understandable summary for the conversation with the ZAC.
- At your request, we are available to the investigators as a technical contact.
- In parallel, we continue incident response so that your operations run securely again as quickly as possible.
Frequently asked questions
Is reporting a cyberattack worthwhile at all?
A report creates official documentation that can be helpful towards insurers, business partners and authorities. It makes investigations possible and contributes to the overall situation picture. Whether it makes sense in an individual case, you can discuss with the ZAC and your legal advisers.
What is a ZAC?
The Zentrale Ansprechstellen Cybercrime (central contact points for cybercrime, ZAC) are specialized police units for companies and authorities, based at the state criminal police offices in Germany. They accept reports, advise on how to proceed and coordinate investigations. An overview is available at polizei.de.
Do I have to stop my operations for the investigation?
As a rule, no. The ZAC are geared to the fact that companies have to keep working, and coordinate measures with you. Clarify questions on evidence preservation and restart in the first conversation.
Does a report automatically become public?
No, a report is not published automatically. It is best to raise questions of confidentiality directly with the ZAC. You continue to control your own external communication.