Do not wait for email. Call the incident response line directly — containment first, paperwork later.