Report an Incident
Incidents can be reported via e-mail or phone. See our contact page for details including OpenPGP information.
Anonymous Contact Form
To report an incident anonymously please use the anonymous report form.
Guideline for Incident Reporting
DISCLAIMER: If you consider criminal prosecution by filing a complaint, contact the police at first.
If you believe you encounter or identified an incident, please complete - as much as possible - the form available at
or send an - preferably GPG/PGP encrypted - email to
- <info (a) circl lu>
In case of emergency, you reach CIRCL on their direct phone line
- (+352) 247 88444
All reported information will be treated confidentially.
CIRCL encourages you to implement the following guidelines:
- CIRCL should be informed as soon as possible once an incident has been detected or suspected
- The first action to undertake should be contacting CIRCL
- CIRCL may act as support for advising you on emergency actions that could be performed
- As far as possible, actions performed on systems/services should aim to preserve evidences
- Once an incident has been detected, every actions undertaken in relation with this incident should be noted
- who, what, when, why, expected outcome of the action and actual outcome
- This implies actions that are dedicated to be performed on systems/services or not
- The scene of crime should not be altered nor modified (as far as possible)
- Instead of turning off a system, unplugging the network connection is usually the better choice regarding the possibility of evidence collection
- Software, applications, files, data or logs should not be installed, re-installed, copied, moved or deleted from the impacted system/services
- This guideline applies also to system/services other than those impacted by the incident: in case of incident, other system/services can be helpful for collection of (additional) evidences or to understand / identify the root cause of the incident
- No major changes should be implemented on the impacted systems/services
- No actions other than those dedicated to contain the incident should be performed
- The eradication of the root cause of the incident / the recovery from the incident should not be performed without evaluating the impact on the evidences
Declaration d'incident et cadre judiciaire
Le premier soucis de CIRCL est d'aider la/les victimes (principalement au Luxembourg) - toujours dans un souci de confidentialité stricte.
Comme tout cas où il y a un dépôt de plainte, CIRCL collabore pleinement avec la Police Luxembourgeoise. La perquisition est une des techniques classiques du système judiciaire pour obtenir des informations nécessaires à clarifier tous les éléments d'une enquête.
Le rôle de CIRCL est la réponse aux incidents liés à la sécurité de l'information ainsi que la coordination des réponses adéquates. CIRCL est en première ligne dans l'intérêt de la sécurité au Luxembourg.
Incident Reporting and Law Enforcement
The first goal of CIRCL is to help the victims of information security incidents (mainly in Luxembourg) while respecting the strict confidentiality of the incidents reported.
In case of legal complaints, CIRCL helps the Luxembourgian law enforcement agencies. A search warrant is one of the techniques used by law enforcement agencies to clear out a current legal investigation.
CIRCL's role is to respond to information security incidents along with its coordination. CIRCL is in the front line for the sole interest of the information security in Luxembourg.