Data Breach Emergency Response
Stop. Breathe. Follow this sequence. The first 72 hours are critical— every action you take now affects your breach outcome.
Critical: Do NOT
- • Delete any files or logs (destroys evidence)
- • Turn off affected systems before forensic imaging (loses volatile memory)
- • Publicly disclose before consulting legal counsel
- • Pay ransom without expert consultation
- • Attempt to "clean up" before investigation
72-Hour Response Timeline
CONTAIN
Your immediate priority is stopping the breach from spreading while preserving evidence. Every action must be documented with precise timestamps.
Disconnect network cables. Do NOT power off. Isolate but preserve.
Firewall, server, application, authentication logs. They may auto-rotate.
IT Lead, CISO, Legal Counsel, CEO/Executive, Communications.
Who discovered it, when, what was observed, actions taken. Be precise.
Lock server rooms. Restrict access. Preserve chain of custody.
INVESTIGATE
Now you assess the scope and engage experts. This phase determines your notification obligations and recovery path.
Professional forensic analysis. Objective investigation. Expert testimony if needed.
Establishes attorney-client privilege. Critical for litigation protection.
Which systems? What data types (PII, PHI, financial)? How many records? Entry point?
GDPR: 72 hours. HIPAA: 60 days. State laws vary. Check all applicable jurisdictions.
Notify carrier within required timeframe. Understand coverage limits and requirements.
COMMUNICATE
Based on investigation findings, prepare and execute your notification strategy. Transparency builds trust; delay damages reputation.
GDPR: 72-hour deadline. File with supervisory authority. Document the process.
Clear, factual, actionable. What happened, what data, what they should do.
Employee awareness. What they can/cannot say. Point of contact for questions.
For public-facing breaches. Media training. Statement preparation.
Dedicated hotline. FAQ page. Credit monitoring vendor (if offering).
REMEDIATE
With investigation insights, begin fixing vulnerabilities and hardening systems. This prevents reinfection and demonstrates due diligence.
Apply security patches. Update outdated software. Close attack vector.
User passwords. Service accounts. API keys. Admin credentials. Force resets.
Increased logging. Alert thresholds. Watch for reinfection or lateral movement.
What happened? What worked? What failed? Document lessons learned.
Incorporate lessons. Update contacts. Improve procedures.
Get Expert Help Now
If you're experiencing an active breach, don't try to handle it alone. We'll connect you with qualified incident response specialists within 2 hours.
Featured IR Firms
Get Emergency Help Now
We'll connect you with incident response specialists within 2 hours.
Why Speed Matters
Organizations with incident response teams and tested plans save $2.66 million compared to those without (IBM 2024).
Breaches take an average of 277 days to identify and contain. Faster detection significantly reduces costs.
Organizations that contain breaches in under 200 days save 54% on total breach costs.
United States has the highest average breach cost globally. Early containment is critical.