Who to report to
Draft: pending legal review.
Reporting duties depend on your facts, your industry, and your contracts. Use this directory to find the official place to report, and confirm with your lawyer what applies to you. Each deadline clock in your plan links here.
22 of 22
FBI Internet Crime Complaint Center (IC3)
FBIFBI-run hub for reporting cyber-enabled crime, filed through the online form at complaint.ic3.gov.
Who reports here: Anyone who has suffered a cyber-enabled crime; page says to file even if unsure the complaint qualifies.
IC3 says it cannot respond to every submission. The only phone printed (202-324-3691) is the FBI Press Office, so it is not listed as a reporting phone. Child exploitation goes to NCMEC and terrorism threats to tips.fbi.gov per the page.
FBI field office finder
FBIFBI page for locating a local field office.
Who reports here: Not confirmed (page blocked).
fbi.gov returned HTTP 403 to our fetcher on /contact-us/field-offices and /investigate/cyber. URL is cited by CISA's report-ransomware page (which I read) as the FBI local contact.
Some details couldn't be verified. Confirm on the official page.
U.S. Secret Service cyber investigations and field offices
U.S. Secret ServiceSecret Service says to report crimes to your local field office; most field offices have a Cyber Fraud Task Force for cyber-enabled financial crime.
Who reports here: Not stated on the cyber page; the field-office page says to report crimes to your local field office.
Field-office page lists a phone per U.S. office (varies by office; not copied here). No email printed. CPNI breach portal data is collected by the Secret Service and FBI per the FCC page.
Deadline clocks served: FCC telecom breach rules (CPNI)
Some details couldn't be verified. Confirm on the official page.
CISA incident reporting
CISA (DHS)CISA's page directs incident reports to its Incident Reporting System and lists contact addresses for cyber issues and significant incidents.
Who reports here: Report-ransomware page: a victim reports to FBI, CISA, or the Secret Service; one report is said to notify the others. Intake form page itself did not render.
Phone: 1-844-Say-CISA · Email: report: central@cisa.dhs.gov (significant cyber/physical incidents); Contact@mail.cisa.dhs.gov (cyber issues)
Contact page also lists Contact@cisa.dhs.gov for CISA Central, and 9-1-1 for emergencies. Voluntary reporting for small organizations; CIRCIA clock status is in our rule file. The IRF form at myservices.cisa.gov/irf was a JavaScript page that did not render, so form fields were not read.
Deadline clocks served: CIRCIA: CISA critical-infrastructure reporting
Some details couldn't be verified. Confirm on the official page.
FTC ReportFraud
Federal Trade CommissionFTC consumer fraud reporting site.
Who reports here: Not confirmed (page text did not render).
Fetched page returned only the site name; purpose not confirmed from the page.
Some details couldn't be verified. Confirm on the official page.
FTC Health Breach Notification form
Federal Trade CommissionFTC's online form for reporting a breach of unsecured information in personal health records under the Health Breach Notification Rule (16 CFR Part 318).
Who reports here: Companies offering or maintaining personal health records that are not covered by HIPAA.
Phone: (202) 326-2918 · Email: Healthbreach@ftc.gov
Page says not to include personal information about the breach in the submission. Timing is in our rule file.
Deadline clocks served: FTC Health Breach Notification Rule
FTC Safeguards Rule Security Event Reporting Form
Federal Trade CommissionFTC form for covered financial institutions to report security events affecting 500 or more people.
Who reports here: Covered financial institutions under the Safeguards Rule; third parties such as attorneys or service providers may submit on an institution's behalf.
No FTC phone/email printed; only a Paperwork Reduction Act mailing address. The ftc.gov/business-guidance/resources/safeguards-rule-notification-form URL is 404.
Deadline clocks served: FTC Safeguards Rule: notice to the FTC
FTC data breach guidance (individualized help)
Federal Trade CommissionPer IRS, the FTC offers a data breach response guide and an email for individualized guidance.
Who reports here: Businesses after a breach (as described by the IRS page).
Email: dt-brt@ftc.gov
Email is printed on the IRS page, not on an FTC page I read.
Some details couldn't be verified. Confirm on the official page.
HHS OCR breach portal
HHS Office for Civil RightsOCR portal for filing a HIPAA breach report or a 42 CFR Part 2 breach report.
Who reports here: Page describes HIPAA covered entities, business associates, Part 2 programs and qualified service organizations as regulated; submitter eligibility not stated.
Page states breaches of 500+ are investigated; smaller ones depending on resources. No account or certificate requirement mentioned. If both HIPAA and Part 2 information are involved, they are reported separately.
Deadline clocks served: HIPAA Breach Notification Rule
Some details couldn't be verified. Confirm on the official page.
SEC EDGAR and Form 8-K Item 1.05 guidance
U.S. Securities and Exchange CommissionEDGAR is the SEC filing system; SEC guide describes Form 8-K Item 1.05 disclosure of material cybersecurity incidents.
Who reports here: Exchange Act registrants (domestic and foreign private issuers) and BDCs per the SEC guide; Form 40-F filers, asset-backed issuers and registered investment companies excluded.
The EDGAR page does not mention Form 8-K or filing instructions; it covers public search. Filing-agent/EDGAR Next access steps not read.
Deadline clocks served: SEC Form 8-K, Item 1.05 (public companies) · SEC Regulation S-P (customer notice)
Some details couldn't be verified. Confirm on the official page.
OCC computer-security incident notification
Office of the Comptroller of the CurrencyOCC Bulletin 2022-8 lists points of contact for bank computer-security incident notifications: BankNet help desk, BankNet submission, or the bank's supervisory office.
Who reports here: OCC-supervised banking organizations (per the interagency rule in our rule file).
Phone: (800) 641-5925 · Email: BankNet@occ.treas.gov
Registered BankNet members can submit from banknet.gov; OCC recommends registering before an incident. Phone and email are the BankNet Help Desk.
Deadline clocks served: Bank computer-security incident notification (OCC, Federal Reserve, FDIC)
Some details couldn't be verified. Confirm on the official page.
FDIC computer-security incident notification
Federal Deposit Insurance CorporationFDIC letter FIL-21-074 says notice goes to the appropriate FDIC supervisory office or an FDIC-designated point of contact by email, telephone or similar methods.
Who reports here: FDIC-supervised banking organizations; bank service providers notify their bank customers.
The letter prints no notification email or phone; it says FDIC would provide logistics later. Supervision@fdic.gov is printed as the Division of Risk Management Supervision contact but not stated to be for incidents, so not listed.
Deadline clocks served: Bank computer-security incident notification (OCC, Federal Reserve, FDIC)
Some details couldn't be verified. Confirm on the official page.
Federal Reserve computer-security incident notification
Board of Governors of the Federal Reserve SystemSR 22-4 gives the Board's contact for computer-security incident notifications.
Who reports here: Banking organizations whose primary federal regulator is the Board.
Phone: (866) 364-0096 · Email: incident@frb.gov
The email is obfuscated in the page HTML; the fetch tool decoded it from the protected-email link. A search summary reported the same address.
Deadline clocks served: Bank computer-security incident notification (OCC, Federal Reserve, FDIC)
Some details couldn't be verified. Confirm on the official page.
NCUA cyber incident report
National Credit Union AdministrationNCUA page lists channels for reporting a cyber incident: online form, phone voicemail, or secure email.
Who reports here: Federally insured credit unions with a reportable cyber incident.
Phone: 1.833.CYBERCU (1.833.292.3728) · Email: cybercu@ncua.gov
Online report at cyberreports.ncua.gov; email goes through the NCUA Secure Email Message Center. Phone is voicemail.
Deadline clocks served: NCUA cyber incident reporting
FCC / CPNI data breach reporting facility
Federal Communications CommissionFCC page says carriers and interconnected VoIP providers notify the Secret Service and FBI electronically through the facility at cpnireporting.gov.
Who reports here: Telecommunications carriers and interconnected VoIP providers (per 47 CFR 64.2011 as described on the page).
This is a legacy 'transition.fcc.gov' page; it describes the Secret Service/FBI notification and does not mention the 2024 FCC-notice amendment. Printed contacts relate to OMB paperwork questions only, so omitted. fcc.gov/data-breach-reporting returned 403 and cpnireporting.gov rendered empty.
Deadline clocks served: FCC telecom breach rules (CPNI)
Some details couldn't be verified. Confirm on the official page.
DoD DIBNet cyber incident reporting
DoD Cyber Crime Center (DC3)dibnet.dod.mil redirects to DC3's DIB Cybersecurity (DCISE) page.
Who reports here: Not confirmed from a readable page; DFARS 252.204-7012 applies to defense contractors (see our rule file).
Only the redirect was observed. A search summary suggested a DoD-approved medium assurance certificate is needed and gave a DCISE hotline and email, but that came from search results, not a page I read, so those are not used.
Deadline clocks served: DFARS 252.204-7012 (defense contractors)
Some details couldn't be verified. Confirm on the official page.
IRS reporting for tax professionals (Stakeholder Liaison)
Internal Revenue ServiceIRS page lists who tax professionals should contact after data theft or loss, starting with the local Stakeholder Liaison, who notifies IRS Criminal Investigation.
Who reports here: Tax professionals whose business suffers a data theft or loss.
Page also lists police, FBI IC3, state tax agencies (via taxadmin.org), state AGs (naag.org), FTC, insurer, credit bureaus and clients. Stakeholder Liaison locator not read.
Some details couldn't be verified. Confirm on the official page.
PCI SSC PCI Forensic Investigators and card breach guidance
PCI Security Standards CouncilPCI SSC qualifies PCI Forensic Investigators; its breach-response guide says to contact your acquirer and payment brands to decide whether a PFI must be engaged.
Who reports here: Entities with a suspected cardholder data breach; acquirers and brands set their own PFI rules.
Email: pfi@pcisecuritystandards.org
Email is for PFI remediation questions. Council says compliance and validation are set by payment brands and acquirers. Guide points to FAQ 1142 for brand contacts. PFI list is a filterable search; names not captured.
Some details couldn't be verified. Confirm on the official page.
NAAG state attorney general directory
National Association of Attorneys GeneralDirectory of the attorneys general of all 50 states, DC and five territories, with profile links.
Who reports here: Not a reporting portal; used to find the AG in each state where affected residents live.
State AG breach portals are a later phase. IRS page points tax pros to naag.org.
Local police report
Local policeIRS page for tax professionals lists filing a report with local police on the breach.
Who reports here: Per IRS, tax professionals after data theft; general guidance not read from another agency page.
No official nationwide directory; use the local department.
Some details couldn't be verified. Confirm on the official page.
OFAC ransomware advisory and reporting
U.S. Treasury OFACOFAC's 2021 advisory page covers sanctions risks tied to ransomware payments and links to OFAC contact and report-submission pages.
Who reports here: Not stated in the summary read; relevant when considering a ransom payment.
Advisory text itself not read.
Some details couldn't be verified. Confirm on the official page.
FinCEN ransomware advisory FIN-2021-A004
FinCEN (U.S. Treasury)FinCEN advisory on ransomware and the use of the financial system to facilitate ransom payments (issued 2021-11-08).
Who reports here: Not confirmed (advisory body not read); aimed at financial institutions per its title.
Only the landing page was read.
Some details couldn't be verified. Confirm on the official page.
We have no affiliation or commercial relationship with any agency or organization listed here. A listing is not an endorsement or a ranking. Contact details come from each organization's own website (checked 2026-11-03) and may change. We list a phone number or email only when we read it on an official page. Spot an error? Tell us. General information only, not legal advice: see the disclaimer.
More resources: all directories · Platform contacts · Choosing an incident-response firm · For affected individuals