...

** AMBER Information – Limited Distribution                               
** This may be shared with trusted security teams on a need-to-know basis
** see https://www.first.org/tlp/ for distribution restrictions         

A security incident has been detected at <ENTITY_NAME>

• Short summary of the incident

• Systems affected

• The attacker used the following systems to connect to the affected systems

• Evidence of the compromise, including timestamps and time zone

• What was lost, details of the attack

• If available and relevant, the list of other eduGAIN participants possibly affected

  • Have they been contacted?

• Possible vulnerabilities exploited by the attacker

• Actions taken to resolve the incident

• Recommendations for other sites, actions suggested

• Timeline of the incident