Whenever you suspect the system under your responsibility has been compromised, you should contact the CU-Boulder IT Security Office. Please email the pertinent incident information to firstname.lastname@example.org or contact the IT Service Center at 303-735-4357 (5-HELP from an on-campus phone).
ITS will need any relevant log files, the IP address of the compromised system, and the timezone if there is any time differential. Never send incident reports via email from a system which has been compromised. To send sensitive information, please encrypt the data using PGP.
IT Security Office will assist you in handling the incident and help determine what other agencies need to be notified.