Data Breach Response: Immediate Steps for Businesses

1. Contain the exposure — revoke a shared link, disable a compromised account or recall a message where possible.
2. Note the discovery time precisely. Many notification timeframes run from when you became aware.
3. Preserve evidence before tidying anything up.
4. Establish the basic facts: what data, whose, how much and how it was accessed — confirmed facts only.
5. Involve whoever has authority to decide — an owner, director or data-protection contact.
6. Start a written timeline and keep it updated as you go.

Signs a breach may have occurred

• Someone reports receiving data that is not theirs.
• A device holding customer, staff or financial records is lost or stolen.
• A folder, spreadsheet or database link was shared more widely than intended.
• A supplier notifies you their systems were compromised.
• Unusual export, download or query activity in a system holding sensitive data.

• Remove public or external access to the affected file, folder or system.
• Change credentials for any account that may have been used to access the data, from a clean device, and turn on multi-factor authentication.
• Remotely lock or wipe a lost device only after recording its details.
• Ask a supplier involved to confirm, in writing, what they have contained.
• If the breach came through a compromised mailbox, follow our hacked email account steps to remove attacker access.

Regulators, insurers and affected people tend to ask similar questions. Capturing this early saves reconstructing it under pressure:

• Access and download logs for the affected system, for the relevant period.
• A description of the data fields involved (rather than copies of the data itself, where avoidable).
• The message, link, sharing setting or configuration that allowed the exposure.
• A list of who had or could have had access, and when that changed.
• Correspondence with any supplier or processor involved.

• Which system, mailbox, device or file share held the data.
• Which accounts had access, and whether any of them are compromised.
• Whether connected systems — cloud storage, CRM, finance tools — are also affected.
• Whether the exposure is over, or still ongoing.

If the breach followed ransomware, see ransomware response steps; if it came from invoice or payment fraud, see business email compromise.

• Personal data — names, contact details, identification numbers.
• Customer information — accounts, orders, correspondence.
• Employee information — HR, payroll or health records.
• Credentials — usernames, passwords or access tokens.
• Financial information — bank or card details, invoices.
• Commercially sensitive information — contracts, pricing, plans.

Record approximately how many people or records are involved, and how sensitive each category is. Exposed credentials should be changed straight away; exposed bank details mean contacting your bank.

Timestamps matter because reporting timeframes often run from when you became aware, and because a clear sequence shows what was done and why. Record:

• When the exposure likely started, and when it was discovered.
• Each containment step, when it happened and who did it.
• Decisions made and who made them.
• Who was told what, and when.

Not every breach must be reported. Whether reporting is needed depends on factors such as the jurisdiction, the type of information involved, the risk to the people affected, your contracts and any applicable regulation.

• Data-protection regulator — under UK GDPR, a personal data breach may need to be reported to the ICO within 72 hours of becoming aware in applicable cases, depending on the risk to individuals. Other countries have their own rules.
• Affected individuals — may need to be told where there is a high risk to them.
• Your insurer — policies often require prompt notice.
• Customers or partners — contracts may include notification terms.
• Your bank — if financial account details were exposed.

Cyber Crisis Desk is not legal counsel. It does not decide whether a breach is notifiable and does not file reports on your behalf; it helps you assemble the facts a regulator, insurer or legal adviser will ask for.

• Close the gap that caused the exposure: settings, permissions, process or training.
• Restore affected systems from checked, clean sources where needed.
• Monitor accounts and systems for repeat access or misuse of the data.
• Keep the case open until follow-up checks are complete.

• Do not destroy evidence — deleting logs, files or accounts to tidy up removes the record of what happened.
• Do not make assumptions about scope or cause before assessing it.
• Do not fail to document actions — reconstructing them later is unreliable.
• Do not prematurely declare the incident resolved.
• Do not assume a small-looking exposure is below any reporting threshold.
• Do not investigate or access any third party's systems. Cyber Crisis Desk is strictly defensive.

1. Exposure contained: links revoked, accounts disabled or devices locked.
2. Discovery time recorded.
3. Logs, settings and correspondence preserved.
4. Affected systems and accounts identified.
5. Data categories and approximate numbers of people listed.
6. Exposed credentials changed; bank contacted if financial data involved.
7. Timeline kept up to date with actions and decisions.
8. Reporting considerations reviewed, with advice where unclear.
9. Insurer contacted if you have cover.
10. Root cause fixed and monitoring in place before closing.

A free emergency check asks what happened, what kind of data may be involved and whether the exposure is ongoing. The platform then selects a data-exposure playbook and builds an Immediate Rescue Plan grouped by urgency.

• Client Next Action keeps containment, fact-finding and notification tasks in a sensible order.
• Evidence requests say exactly what to capture, stored in your private case.
• A running timeline records discovery time, decisions and actions.
• Structured reports turn the case into a document for a regulator, insurer or adviser.

Smaller organisations may also find our cyber incident response guide for small businesses useful. See how the guided workflow fits together or compare the plans and the one-time Emergency Pass.

• We do not decide notifiability; that rests with you and, where appropriate, your legal adviser.
• We do not provide legal advice or make legal determinations of any kind.
• We cannot access, change or investigate systems on your behalf.
• This is guided response, not a substitute for a qualified incident-response team or legal counsel where an incident is severe, regulated or contested.

How do I know if a breach is 'reportable'?

It depends on the data involved, the number of people affected and the likely risk to them, assessed against the rules where you and they are based. Cyber Crisis Desk helps you gather the facts; the decision needs your own judgement or legal advice.

Do I need to tell customers even if I'm not sure data was taken?

Many organisations communicate once a credible risk exists, rather than waiting for complete certainty, because some timeframes run from when you became aware. Take advice on your situation.

What if the breach happened at a supplier, not us?

You may still have obligations to your own customers or staff. Get written confirmation from the supplier of what happened and when, and keep it with your evidence.

Can Cyber Crisis Desk file the regulator report for us?

No. We are not a legal or regulatory filing service. We help you organise the timeline, evidence and facts so that you, or whoever files for you, can do so accurately.