Information security incident

What is an information security incident

An information security (IS) incident is any unwanted or unforeseen event (or a series of them) that violates or creates a threat of violation of the confidentiality, integrity or availability of information and IT systems. In simple words, it is an occurrence when your data ended up in the wrong hands, was irretrievably lost or the system stopped working.

It is important to distinguish an incident from a security event. An event is any change in the system that can be both normal and suspicious (for example, a user entered a wrong password). An incident is an event that caused or could cause real damage (for example, an attacker hacked a password and entered the system, stole data or encrypted files).

According to statistics, more than 80% of companies face at least one serious IS incident a year. The cost of eliminating the consequences of one incident on average amounts to millions of rubles, and restoring a reputation can take years. According to Kaspersky Lab, in 2025 the average cost of one incident for Russian business was 12.4 million rubles, and the recovery time was from several days to several weeks. Read about preventing such situations in the article Information security.

Main types of incidents

Information security incidents are classified by the type of threat and the nature of the impact. The most common types:

• Malware: Infection with viruses, ransomware (encryptors), spyware, trojans, worms and rootkits. Malware can steal data, encrypt files, make the system part of a botnet or completely take it out of operation.
• Unauthorized access: Hacking attacks, password cracking, illegal privilege escalation, theft of accounts, use of vulnerabilities to gain access to systems. Unauthorized access is one of the most common causes of data leaks.
• Data leaks and compromise: Illegal copying, deletion or publication of confidential documents, client databases, personal data, trade secrets or state secrets. Leaks can be both external (hackers) and internal (insiders).
• Availability violation: DDoS attacks (distributed denial-of-service attacks), system blocking, equipment damage, software failures because of which employees and clients cannot access services.
• Social engineering: Successful phishing attacks, when employees follow malicious links, open infected attachments or give attackers credentials and confidential documents under the pretext of a “check” or “official request”.
• Internal violations (insider threats): Intentional or accidental disclosure of data by employees, sending confidential information to the wrong addressee, transferring data to personal media or cloud storage.

Read more about types of cyberattacks in the article Cyber fraud.

Incident lifecycle

According to standards (for example, NIST SP 800-61 and domestic methodological recommendations), the classic incident handling process includes the following stages:

• Detection and recording: Detection of suspicious activity in the system. This can be a trigger of an SIEM system, EDR, antivirus, a user complaint or detection of anomalies in logs.
• Analysis: Assessment of the scope of the threat, identification of affected systems, determination of the attack type and search for its source. SOC analysts conduct an investigation using logs, network traffic and forensics data.
• Containment and response: Blocking the attack and preventing its spread. Isolation of infected systems from the network, blocking attackers' IP addresses, disabling compromised accounts.
• Remediation and recovery: Removal of malware, data recovery from backups (backup system), restoration of system operability, closing the vulnerabilities through which the penetration occurred.
• Incident analysis (post-mortem): Identification of vulnerabilities, development of measures to prevent similar situations in the future, updating security policies, training employees, preparing a report for management and regulators (if necessary).

Read about data recovery methods in the article Data backup.

How to respond to an incident

Correct response to an incident is critical for minimizing damage. The recommended order of actions:

• Immediately isolate infected systems from the network (disconnect from the local network and the internet) to prevent the attack from spreading to other devices.
• Save all logs and evidence for the investigation: system logs, event files, memory dumps, copies of infected files. Do not delete or modify any data until the investigation is complete.
• Notify management and the security service in accordance with the internal incident response procedure.
• Involve specialists in incident investigation (forensics) for professional analysis and evidence collection.
• Notify regulators (Roskomnadzor, FSTEC, Bank of Russia) in cases provided by law (for example, in case of a personal data leak under 152-FZ or incidents at critical information infrastructure facilities). The notification period is usually 24 hours from the moment of detection.

Read about legal aspects in the article Federal Law 152-FZ.