Report a cyber incident
How to report a cyber incident or threat at Oxford
Security incidents
How to report
Please contact the Oxford University Emergency Response team (OxCERT) via email on [email protected] to report an incident.
For urgent inquiries contact the team at +44 1865 282 222 or phone extension 82 222.
When reporting the incident please provide as much detail as possible including:
- Affected system and users (hostname, IP address, user names and account types)
- Date the incident occurred
- Symptoms
- Impact
- Has the incident been handled or do you need support?
- Are there any mitigations in place?
- Is personal or sensitive personal data at risk?
How to report a potential data breach
If you suspect a data breach has occurred please also email the Information Compliance Team (ICT): [email protected] for all potential breaches involving personal data. You should do this in addition to contacting OxCERT, not instead of doing so.
Suspected phishing message
How to report a suspect phishing message
If you wish to report a phishing or other malicious email, please forward the message to [email protected].
Remember to tell us whether or not you:
- Divulged any credentials
- Downloaded any attachments
- Clicked on any links
- Also include full email headers
Please note that the suspect phishing reporting service cannot respond to reports of spam messages or other forms of unsolicited email.
To help reduce phishing incidents we are updating the University (SSO) log-in process. Find out more information about the changes to how you log-in.
Suspected ransomware incident
Ransomware on your work device? Follow these steps
Ransomware is a type of malicious software, often shortened to 'malware', which encrypts your data or device and demands a ransom (e.g., for access to be restored).
If this has happened to your device, don’t panic, follow these steps:
- Disconnect from the network by immediately removing any data network cable connecting your device to a network, to isolate your workstation, and/or activating 'Airplane' mode if you are connected to a wireless network.
- Don't shut down your device – keep it turned on for further investigation by IT staff
- Capture evidence of any error message or demands (e.g., by taking a photograph or screenshot). Note the time, and actions you took leading up to the incident.
- Report it to your local IT support staff as soon as possible. If they are unavailable, contact Information Security (using an uninfected device) at [email protected] or call +44 (0)1865 282 222.
When you speak to IT Support Staff or Information Security, you may be asked about:
- Which systems and users are affected
- Whether you have put any mitigations in place (e.g. disconnecting from networks)
- The kind of data (personal/sensitive) that is at risk