How to Report a Cybercrime or Hack in CT and NY (2026)
Written by Paul Pioselli on April 3, 2026
7 min read
In my work protecting individuals, executives and families across Fairfield and Westchester Counties, one question comes up more than any other once someone has been compromised:
“Who do I even call?”
It sounds simple. But in the middle of a cybersecurity emergency, when your email’s been hijacked, your bank account’s been impacted, or someone’s impersonating you online, knowing the right reporting channels isn’t just helpful. It’s critical. The faster you report, the better your chances of recovering assets, building a legal record, and stopping the attacker from doing more damage.
This guide is specifically for individuals living in Connecticut and New York. I’m going to walk you through exactly who to contact, what to expect, and how to protect yourself before, during, and after a cyber incident.
Why Reporting Cybercrime Matters More Than You Think
Many people I work with in Greenwich, Darien, Stamford, Westport, and the Westchester corridor assume cybercrime is a corporate problem. It’s not. Individual victims, particularly professionals, executives, and their families, are prime targets for identity theft, social engineering, business email compromise, and account takeover attacks.
Here’s the uncomfortable truth: a significant percentage of cybercrimes against individuals go unreported. People feel embarrassed, don’t think anything will come of it, or simply don’t know where to start. But reporting creates a paper trail that’s essential for insurance claims, credit restoration, legal proceedings, and, importantly, helping law enforcement identify patterns that lead to arrests.
The numbers underscore how serious this has become. According to the FBI’s 2024 Internet Crime Report, IC3 received 859,532 complaints in 2024 alone, with reported losses exceeding $16 billion, an astounding 33% increase from the prior year. The top three complaint categories were phishing and spoofing, extortion, and personal data breaches. And victims over the age of 60 suffered the most severe financial losses, approaching $5 billion as a group. You can review the full 2024 IC3 Annual Report (PDF) for a deeper look at the data.
Every report you file contributes to a bigger picture that agencies use to dismantle criminal networks. Your report matters.
File a Complaint with the FBI's Internet Crime Complaint Center (IC3)
No matter where you live in Connecticut or New York, your first stop should be the FBI’s Internet Crime Complaint Center (IC3). The FBI is the lead federal agency for investigating cyberattacks, and IC3 is their centralized intake system for internet-related crimes. Since its founding in 2000, IC3 has collected over 9 million complaints and now averages more than 2,000 per day.
You can file a complaint whether you’re the direct victim or reporting on behalf of someone else. IC3 accepts reports covering a wide range of cyber offenses, including online fraud and scams, ransomware attacks on personal devices, business email compromise, identity theft, cryptocurrency fraud, romance scams, and tech support fraud.
IC3’s Recovery Asset Team has also helped freeze stolen funds in many cases, making rapid reporting especially important when money has been transferred. The U.S. Department of Justice also maintains an IC3 resource page with additional guidance.
What to Include in Your IC3 Report
Be thorough. Include dates, dollar amounts, screenshots of suspicious emails or messages, any phone numbers or email addresses the attacker used, transaction IDs, and a clear timeline of what happened. The more detail you provide, the more actionable your report becomes.
Complaints filed through IC3 are analyzed and may be referred to federal, state, local, or international law enforcement for investigation. They also feed into the FBI’s annual Internet Crime Report, the data from your complaint directly informs national threat intelligence.
Connecticut: Report to Your State and Local Authorities
If you’re based in Connecticut, you have several state and local resources designed to handle cybercrime investigations.
Connecticut Division of Emergency Management and Homeland Security (DEMHS)
The state’s DEMHS cybersecurity division handles both cyber threats to infrastructure and cybercrimes affecting residents. The Connecticut Intelligence Center (CTIC) operates within DEMHS and works to protect entities in the state by providing tactical intelligence to detect malicious activity and strategic intelligence to reduce vulnerabilities. CTIC asks that both successful and unsuccessful cyber incidents be reported; you can email them at ctic@ct.gov or use their online Cyber Incident Reporting Guide available on the DEMHS cybersecurity page.
You can also report suspicious activity statewide by calling 866-HLS-TIPS (866-457-8477), online at portal.ct.gov/tip, or via the CTSafe mobile app.
The District of Connecticut Cybercrime Program (U.S. Department of Justice)
This federal program operates within the state and handles prosecutions of significant cyber offenses. If your case involves substantial financial loss or crosses state lines, which many cyber incidents do, this office becomes particularly relevant.
Connecticut Center for Digital Investigations (CDI)
Housed within the Glastonbury Police Department, the CDI is a regional resource for digital forensics and cybercrime investigation. If you need local law enforcement with technical forensic capabilities, this is one of the strongest options in the state.
Your Local Police Department
Even if your town doesn’t have a specialized cybercrime unit, always file a police report with your local department. This creates an official record that’s often required for insurance claims, credit bureau disputes, and legal proceedings. If they can’t investigate directly, they’ll escalate to the appropriate state or federal agency.
New York: Report to Your State and Local Authorities
New York has a more extensive network of cybercrime enforcement resources, reflecting the state’s size and the volume of cyber incidents it handles.
New York State Attorney General: Bureau of Internet and Technology (BIT)
The AG’s Bureau of Internet and Technology investigates internet-based fraud, data breaches, and privacy violations affecting New York residents. BIT has been a pioneer in this space, bringing cases related to child safety, privacy violations, deceptive trade practices, consumer fraud, and more. In 2024 alone, the AG’s office settled with 12 companies over privacy and cybersecurity breaches, imposing penalties exceeding $14 million. The office has also pursued innovative enforcement actions, such as its investigation into credential stuffing attacks that compromised over 1.1 million consumer accounts. If a company has failed to notify you of a data breach or you’ve been targeted by an online scam, this office should be on your list.
NYPD Computer Crimes Squad
For residents of New York City, the NYPD maintains a dedicated Computer Crimes Squad that handles investigations into hacking, identity theft, online fraud, and other technology-facilitated crimes. The squad also partners with the FBI’s Financial Cyber Crimes Task Force, which was established jointly by the FBI, NYPD, and MTA to target cyber-related criminal activity in the region. If you live in the five boroughs, file a report here in addition to your IC3 complaint.
New York State Police: Computer Crime Unit
The State Police Computer Crime Unit handles cybercrime investigations across New York outside of NYC jurisdiction. The CCU currently consists of 52 sworn and non-sworn members and provides three core functions: field investigations, a Computer Forensic Laboratory, and the Internet Crimes Against Children Task Force (ICAC). If you’re in Westchester County, the Hudson Valley, or anywhere in the state beyond the city, this is your primary state-level resource.
Brooklyn and Queens District Attorneys' Offices: Cybercrime Units
Both the Brooklyn DA and Queens DA maintain specialized cybercrime units. If you’re in Kings or Queens County and the crime has a clear local nexus, these offices can pursue prosecution at the county level.
New York County DA: Resources for Identity Theft and Cybercrime Victims
The Manhattan DA’s office provides victim resources specifically for identity theft and cybercrime cases. If you’ve been victimized and need guidance on recovery, this office offers practical support alongside investigation referrals.
Report to the Federal Trade Commission (FTC)
In addition to IC3, file a report with the FTC at ReportFraud.ftc.gov. The FTC tracks fraud and identity theft nationwide, and your report feeds into the Consumer Sentinel Network, a database used by thousands of law enforcement agencies.
If your case specifically involves identity theft, use IdentityTheft.gov to create a personalized recovery plan. This FTC resource walks you through disputing fraudulent charges, placing fraud alerts, and notifying creditors, step by step. You can also reach the FTC’s Consumer Response Center by calling 1-877-FTC-HELP (1-877-382-4357).
What to Do Immediately After a Cyber Incident
Before you even start filing reports, take these protective steps to limit the damage.
Secure Your Accounts
Change passwords on any compromised accounts immediately. If you’re not sure which accounts are affected, start with email, banking, and any account that uses the same password as a compromised one. Enable multi-factor authentication everywhere it’s available, and use an authenticator app, not SMS, whenever possible.
Freeze Your Credit
Contact all three major credit bureaus, Equifax, Experian, and TransUnion , and place a security freeze on your credit files. This prevents anyone from opening new accounts in your name. A freeze is free, and it’s one of the single most effective steps you can take after identity theft.
Preserve Evidence
Do not delete suspicious emails, text messages, or transaction records. Screenshot everything. Save URLs. Document the timeline of events while it’s fresh. This evidence is essential for both law enforcement investigations and any legal action you may pursue.
Contact Your Financial Institutions
Call your bank and credit card companies immediately. Alert them to the compromise, flag or freeze affected accounts, and ask about their fraud recovery procedures. Most financial institutions have dedicated fraud teams that can act quickly when notified early.
Building Your Personal Cybersecurity Posture: Prevention for CT and NY Residents
Reporting is reactive. What I’m most passionate about at Solace is helping people in Fairfield County, Westchester County, and across Connecticut and New York build proactive defenses so they never need to make that call in the first place.
Invest in Personal Threat Monitoring
High-net-worth individuals and executives face a disproportionate level of targeting. Your personal information, home address, family members’ names, financial holdings, travel patterns, lives across dozens of data brokers and public databases. A personal cybersecurity firm can monitor for exposure, remove your data from broker sites, and alert you to threats before they materialize.
Conduct a Personal Digital Risk Assessment
Most of my clients are stunned by what we uncover in an initial assessment: old accounts with reused passwords, sensitive documents stored in insecure cloud services, family members with wide-open social media profiles that reveal home locations and routines. You can’t protect what you don’t know is exposed.
Protect Your Home Network
Your home network in Westport or Scarsdale is an attack surface, full stop. Default router passwords, unpatched smart home devices, and guest networks without segmentation are all vulnerabilities. Enterprise-grade network security isn’t just for the office anymore.
Plan for Executive Travel
If you travel frequently, especially internationally, your devices are at elevated risk. Public Wi-Fi, hotel business centers, and even USB charging stations in airports can be vectors for compromise. A personal cybersecurity plan should include travel protocols, secure communication tools, and device hardening before every trip.
A Quick-Reference Reporting Checklist for Connecticut and New York
Here’s the streamlined sequence I recommend to every client who’s been compromised.
Immediately: Secure accounts, freeze credit, preserve evidence, contact financial institutions.
Within 24 hours: File an IC3 complaint at ic3.gov. File an FTC report at ReportFraud.ftc.gov (or IdentityTheft.gov for identity theft). File a local police report.
Within 48 hours: Contact the appropriate state agency depending on your place of residence: Connecticut DEMHS Cybersecurity, the CT Center for Digital Investigations, the New York State Attorney General’s Bureau of Internet and Technology, or the NYS Police Computer Crime Unit, depending on your location. Notify your insurance provider if you have a cyber insurance policy or homeowner’s policy with cyber coverage.
Ongoing: Monitor your credit reports, review account activity, and consider engaging a personal cybersecurity firm to manage recovery and harden your defenses going forward.
You Don't Have to Navigate This Alone
Being the victim of a cybercrime is disorienting, stressful, and deeply personal. I’ve walked many individuals and families through incidents ranging from simple phishing compromises to sophisticated, targeted attacks. The process of reporting, recovering, and rebuilding your digital security posture is a daunting task, but it helps enormously to have an expert in your corner.
At Solace – Truly Personal Cybersecurity, we provide personal cybersecurity protection and emergency response for individuals and executives in Connecticut and New York, with deep expertise in the Fairfield and Westchester County communities we serve. Whether you’re in crisis mode and need immediate incident response, or you want to get ahead of threats with proactive protection, we’re here.
Frequently Asked Questions (FAQ)
What is the first thing I should do if I've been the victim of a cybercrime in Connecticut or New York?
Before you file a single report, secure your accounts. Change passwords on any compromised or potentially compromised accounts — starting with email and financial institutions. Enable multi-factor authentication wherever it is available. Contact your bank to flag suspicious activity, and place a security freeze with all three credit bureaus (Equifax, Experian, and TransUnion). Once you’ve contained the immediate exposure, file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov within 24 hours.
How do I file a cybercrime complaint with the FBI's IC3?
Visit ic3.gov and select “File a Complaint.” You can report as the direct victim or on behalf of someone else. Be prepared to provide a detailed timeline, dollar amounts involved, screenshots of suspicious communications, email addresses or phone numbers used by the attacker, and any transaction identifiers. IC3 reviews every submission and refers actionable complaints to the appropriate federal, state, or local agency. You will not receive a direct response from IC3, but your report contributes to active investigations and national threat intelligence.
Should I file a police report for a cybercrime even if my local department doesn't have a cybercrime unit?
Yes, and this step is more important than most people realize. A local police report creates an official record that is frequently required for insurance claims, credit bureau disputes, and legal proceedings. If your local department lacks specialized cybercrime resources, they are still obligated to take the report and can escalate it to state or federal agencies. In Connecticut, cases are often referred to the Connecticut Intelligence Center (CTIC) or the Connecticut Center for Digital Investigations. In New York, escalation typically routes to the New York State Police Computer Crime Unit or the NYPD Computer Crimes Squad.
Who do I contact to report a cybercrime in Connecticut?
Connecticut residents should report to multiple agencies depending on the nature and severity of the incident. Start with the FBI’s IC3 at ic3.gov. Then contact the Connecticut Division of Emergency Management and Homeland Security (DEMHS), which oversees the state’s cybersecurity response through the Connecticut Intelligence Center (CTIC), you can email ctic@ct.gov or use their online Cyber Incident Reporting Guide. The Glastonbury Police Department’s Connecticut Center for Digital Investigations (CDI) and the Waterbury Police Department’s Computer Crimes Unit also handle cybercrime cases. Additionally, file a report with the FTC at ReportFraud.ftc.gov and with your local police department.
Who do I contact to report a cybercrime in New York?
New York residents have access to one of the most extensive cybercrime enforcement networks in the country. File with IC3 at ic3.gov first. Then contact the New York State Attorney General’s Bureau of Internet and Technology, which investigates internet fraud, data breaches, and privacy violations affecting state residents. If you are in New York City, the NYPD Computer Crimes Squad handles local investigations and partners with the FBI’s Financial Cyber Crimes Task Force. Outside of NYC, the New York State Police Computer Crime Unit is your primary state-level resource. The Brooklyn and Queens District Attorneys’ offices also maintain dedicated cybercrime units. File concurrently with the FTC and your local police department.
What is the difference between a credit freeze and a fraud alert, and which should I request?
A credit freeze restricts access to your credit file entirely, preventing lenders from pulling your report to open new accounts. A fraud alert flags your file and requires creditors to take additional verification steps before extending credit in your name. I recommend a credit freeze as the stronger protective measure — it is free, can be lifted temporarily when you need to apply for credit, and provides a more definitive barrier against unauthorized account openings. You should place a freeze with all three bureaus: Equifax, Experian, and TransUnion. A fraud alert is a reasonable supplementary step, but it relies on creditors to follow through on the verification process, which is not guaranteed.
Will the FBI or local police actually investigate my cybercrime report?
It depends on the scope and financial impact of the case. Federal agencies like the FBI prioritize cases involving significant financial losses, organized criminal networks, or national security implications. IC3 received over 859,000 complaints in 2024 alone, so not every report results in a direct investigation, but every submission is analyzed and may be referred to the appropriate agency. State and local resources, such as the NYPD Computer Crimes Squad or the Connecticut State Police Cyber Crimes Investigation Unit, may be more responsive to individual cases with a clear local nexus. Regardless of whether a full investigation is initiated, your report creates an official record that supports insurance recovery, legal proceedings, and the broader law enforcement effort to track and dismantle criminal operations.
Are high-net-worth individuals at greater risk for cybercrime?
Significantly. Affluent individuals, executives, and their families are disproportionately targeted because of the potential financial return to the attacker. Threat actors conduct detailed open-source reconnaissance, gathering home addresses, family members’ names, travel patterns, financial affiliations, and corporate roles from data brokers, public records, and social media, to craft highly personalized attacks. Business email compromise, spear phishing, account takeover, and impersonation schemes are especially prevalent in this demographic. A proactive personal cybersecurity posture, including threat monitoring, data broker removal, digital risk assessments, and secure communications, is not optional for individuals in this risk category. It is essential.
Dealing with a cyber emergency right now?
Don't wait. Every minute matters.
