A method and intrusion manager (200) for handling intrusion to an electronic equipment (202). When a sensor (204) detects (2:2) an intrusion to the electronic equipment, an intrusion entry indicating the detected intrusion is stored (2:3), and an associated sign-off message which identifies the stored intrusion entry is also stored (2:5). The sign-off message comprises a signature that validates the detected intrusion, which signature may be received (2:4) as input from an authorised person. Thereby, any stored intrusion entry can be checked by searching for an associated sign-off message, and a stored intrusion entry having no matching sign-off message with a valid signature can be determined to be unauthorised.