What should my business do after a data breach?

The short version

• Secure: stop the leak, change credentials, and don’t destroy evidence.
• Fix: find and close the weakness, with help from forensics experts if needed.
• Notify: your insurer, law enforcement, and, depending on state law, affected people and others.
• Report: ic3.gov for crimes, cisa.gov/report for attacks on your systems.
• Get advice: breach laws differ by state. This isn’t legal advice.

What counts as a data breach?

A breach is when personal information you hold is accessed or taken by someone who shouldn’t have it. Examples: a hacked mailbox full of customer details, a stolen unencrypted laptop, a vendor that leaked your customer list, or a website form database that was exposed. A hacked account that held no personal information is still serious, but notification laws may not apply. See the first hour after an account takeover for that.

What are the steps?

The FTC’s Data Breach Response guide groups them into three parts.

1. Secure your operations

1. Stop further loss. Take affected computers offline, but don’t switch them off. Change passwords and sign-in credentials for affected accounts.
2. Remove exposed information that was posted publicly, such as on your website, and ask search engines to remove cached copies.
3. Talk to the people who found it, and write down what they saw and when.
4. Don’t destroy evidence. No wiping or reinstalling until investigators say so.
5. Call your insurer’s breach line if you have cyber insurance. Many policies want notice quickly and may assign forensics and legal help.

2. Fix the weakness

1. Find how they got in: a stolen password, an unpatched system, a vendor. Bring in a forensics firm if you can’t tell.
2. Check your vendors. If a vendor was the source, confirm they’ve fixed it and limit their access. See vendor access.
3. Close the gap: updates, new passwords, passkeys, removed accounts.
4. Plan your communications, so everyone tells customers the same thing.

3. Notify the right people

The FTC lists who may need to know:

• Law enforcement: local police, or the FBI through ic3.gov.
• Affected people, under your state’s law. The National Conference of State Legislatures notes all 50 states, plus DC, Guam, Puerto Rico and the US Virgin Islands, have breach notification laws. Customers in other states may bring their states’ laws into play.
• Other businesses affected, such as your bank if payment details were exposed.
• Credit bureaus, in some cases.
• Regulators, if you’re covered by health privacy rules or other sector rules.

The FTC’s guide includes a model notification letter. It suggests telling people what happened, what information was involved, what you’re doing and what they can do, including pointing them to IdentityTheft.gov.

Where else should I report?

• CISA at cisa.gov/report, for attacks on your systems, such as ransomware.
• The FTC at ReportFraud.ftc.gov, for scams.
• Your bank, straight away, if money or payment details were involved. See business email compromise.

What are the common mistakes?

• Wiping everything to “clean up,” which destroys the evidence you need.
• Saying too much too soon. Early guesses often turn out wrong. Tell people what you know, and update them.
• Saying too little. Hiding a breach makes it worse when it comes out.
• Missing the insurer’s deadline.
• Fixing the symptom, like one hacked mailbox, without finding how the attacker got in.

What if I’m not sure it’s a breach?

Treat it as one until you know. Secure, preserve evidence and get advice. It’s easier to stand down than to catch up.

How much does it cost, and how long does it take?

Securing and fixing can take days. Notification timelines depend on your state’s law. Forensics and legal costs vary; cyber insurance may cover them.

How does E-3 handle this?

For websites we look after through website care, daily backups mean a clean copy of the site can be restored once the hole is closed. If a website or a mailbox E-3 provides may be involved, call us at 814-399-4655. For your website’s side, our help article on what to do if your site was hacked covers the first steps.

Related questions

• What do I do in the first hour after an account takeover?
• How do I protect my business from ransomware?
• What does cyber insurance cover?
• What privacy laws apply to my website?
• Back to cybersecurity basics

Sources

1. Data Breach Response: A Guide for Business (Federal Trade Commission)
2. Security breach notification laws (National Conference of State Legislatures)
3. Internet Crime Complaint Center (FBI)
4. Report fraud (Federal Trade Commission)
5. Report a cyber incident (CISA)
6. IdentityTheft.gov (Federal Trade Commission)