Data Breach
Emergency Response
Stop. Breathe. Follow this sequence.
The first 72 hours are critical—every action you take now affects your breach outcome.
Get Emergency Help Now
We'll connect you with incident response specialists within 2 hours.
Critical: Do NOT
- • Delete any files or logs (destroys evidence)
- • Turn off affected systems before forensic imaging (loses volatile memory)
- • Publicly disclose before consulting legal counsel
- • Pay ransom without expert consultation
- • Attempt to "clean up" before investigation
72-Hour Response Timeline
CONTAIN
Your immediate priority is stopping the breach from spreading while preserving evidence. Every action must be documented with precise timestamps.
Disconnect network cables. Do NOT power off. Isolate but preserve.
Firewall, server, application, authentication logs. They may auto-rotate.
IT Lead, CISO, Legal Counsel, CEO/Executive, Communications.
Who discovered it, when, what was observed, actions taken. Be precise.
Lock server rooms. Restrict access. Preserve chain of custody.
INVESTIGATE
Now you assess the scope and engage experts. This phase determines your notification obligations and recovery path.
Professional forensic analysis. Objective investigation. Expert testimony if needed.
Establishes attorney-client privilege. Critical for litigation protection.
Which systems? What data types (PII, PHI, financial)? How many records? Entry point?
GDPR: 72 hours. HIPAA: 60 days. State laws vary. Check all applicable jurisdictions.
Notify carrier within required timeframe. Understand coverage limits and requirements.
COMMUNICATE
Based on investigation findings, prepare and execute your notification strategy. Transparency builds trust; delay damages reputation.
GDPR: 72-hour deadline. File with supervisory authority. Document the process.
Clear, factual, actionable. What happened, what data, what they should do.
Employee awareness. What they can/cannot say. Point of contact for questions.
For public-facing breaches. Media training. Statement preparation.
Dedicated hotline. FAQ page. Credit monitoring vendor (if offering).
REMEDIATE
With investigation insights, begin fixing vulnerabilities and hardening systems. This prevents reinfection and demonstrates due diligence.
Apply security patches. Update outdated software. Close attack vector.
User passwords. Service accounts. API keys. Admin credentials. Force resets.
Increased logging. Alert thresholds. Watch for reinfection or lateral movement.
What happened? What worked? What failed? Document lessons learned.
Incorporate lessons. Update contacts. Improve procedures.
Frequently Asked Questions
What is the first thing I should do during a data breach?
Isolate affected systems immediately to prevent the spread of the attack, but do NOT turn them off. Turning off systems can destroy volatile memory which is critical for forensic investigation. Disconnect them from the network instead.
Should I pay the ransom?
The FBI and most security experts advise against paying ransoms, as it does not guarantee data recovery and funds criminal activity. However, this is a business decision. Consult with legal counsel and a professional ransomware negotiator before making any decisions.
When do I need to notify customers?
Notification timelines vary by jurisdiction. GDPR requires notification within 72 hours. HIPAA requires notification within 60 days. State laws vary. Consult legal counsel immediately to determine your specific obligations.
Do I need to contact law enforcement?
You are not always legally required to contact law enforcement, but it is often recommended. The FBI or CISA can provide threat intelligence and assistance. Your legal counsel can advise on the best timing and approach for contacting authorities.
Why Speed Matters
Organizations with incident response teams and tested plans save $2.66 million compared to those without (IBM 2024).
Breaches take an average of 277 days to identify and contain. Faster detection significantly reduces costs.
Organizations that contain breaches in under 200 days save 54% on total breach costs.
United States has the highest average breach cost globally. Early containment is critical.