Suspecting that customer, employee, or business data has been stolen is one of the most stressful moments a small business can face. What you do in the first 24–48 hours shapes your legal exposure, your customers' trust, and how quickly you recover. This guide walks through identification, containment, notification, and documentation.
Identifying a Breach
- Unusual outbound data transfers or spikes in network traffic
- Alerts from security tools about data exfiltration
- A ransomware note claiming to have copied your data
- Reports of your customer data appearing on the dark web or for sale
- Unauthorized access to databases, file shares, or cloud storage
- A vendor or partner notifies you that your shared data was exposed
- Unexplained account activity or new admin accounts
Not every security incident is a data breach. A breach specifically involves unauthorized access to, or acquisition of, sensitive data (personal information, financial records, health data, trade secrets, etc.). Determining whether data was actually accessed or copied—not just whether a system was compromised—is the first critical question.
Immediate Containment (First 24 Hours)
Stop the Bleeding
- Isolate affected systems: Disconnect compromised servers, databases, or accounts from the network without shutting them down (this preserves evidence).
- Assemble your response team: IT/security lead, executive sponsor, legal counsel, and communications lead. Small organizations should identify these people now if not already named.
- Preserve evidence before making changes: Screenshot logs, save copies of relevant system states, and note exact timestamps of what you observe.
- Determine what data was involved: Names, SSNs, payment card data, health records, login credentials? The type of data determines your legal obligations.
- Change credentials for affected and adjacent systems: Reset passwords and revoke active sessions/API tokens from a clean device.
- Contact legal counsel immediately: Breach notification laws vary significantly by state and data type—legal guidance early prevents costly missteps.
- Contact your cyber insurance carrier: Many policies require early notification and can connect you with approved forensic and legal resources.
24–48 Hour Action Plan
Assess Scope and Prepare to Notify
- Engage forensic investigators: Determine exactly what was accessed, when, how, and by whom (if identifiable).
- Identify affected individuals or organizations: Build a list of whose data was involved—this drives notification scope.
- Review applicable laws and contracts: State breach notification laws, industry regulations (HIPAA, GLBA, PCI-DSS), and contractual obligations to customers or vendors.
- Draft notification communications: Prepare customer, employee, regulator, and (if needed) public statements with legal review before sending.
- Set up support resources: Credit monitoring, dedicated phone line, or FAQ page for affected individuals if the breach involves personal data.
- Document every decision and action taken: This record matters for regulators, insurers, and any future legal proceedings.
Notification Requirements
- State laws: All 50 U.S. states have data breach notification laws with different triggers and deadlines (often 30–60 days, some as short as 72 hours for certain industries)
- Industry regulations: HIPAA (healthcare), GLBA (financial services), PCI-DSS (payment cards) each have their own notification timelines and requirements
- Contractual obligations: Vendor and customer contracts often specify notification deadlines that can be shorter than legal minimums
- International data: GDPR requires notification to regulators within 72 hours of becoming aware, if you handle EU resident data
- Insurance requirements: Many cyber policies require notifying the carrier before you notify anyone else
Documentation & Evidence Preservation
What to Document
Stakeholder Communication
Who to Tell, and In What Order
- Leadership and board: Brief immediately, before any external communication
- Legal counsel and insurer: Engage before drafting any notification
- Regulators: Notify per applicable law's timeline, with legal counsel's guidance on exact wording
- Affected individuals: Clear, plain-language notice explaining what happened, what data was involved, and what they should do
- Employees: Internal briefing so staff can answer basic questions consistently and know not to speculate publicly
- Media/public (if applicable): A prepared statement for significant breaches, coordinated with legal and communications counsel
Breach Notification Template
Customer/Individual Notification Letter (Starting Point)
Subject: Important Notice About Your Data
Dear [Name],
We are writing to inform you of a data security incident that may have affected your personal information. On [date], we discovered that [brief description of what happened]. Our investigation determined that the following information may have been involved: [specific data types].
We took immediate action to contain the incident, including [containment actions]. We have also [notified law enforcement/engaged forensic investigators/etc.].
We recommend you [specific protective steps: monitor accounts, place a fraud alert, change passwords, etc.]. We are offering [credit monitoring/identity protection services, if applicable] at no cost to you.
If you have questions, please contact us at [phone/email/dedicated line]. We take the security of your information seriously and apologize for this incident.
Sincerely, [Name/Title]
Compliance & Legal Considerations for SMBs
- Retain outside legal counsel with data breach experience—generic business attorneys may not know current notification requirements
- If you accept payment cards, review PCI-DSS obligations, which may require notifying your payment processor and card brands
- If you handle health information, HIPAA breach notification rules apply strict timelines (60 days to individuals, sooner to HHS for large breaches)
- Multi-state notification is common—affected individuals in different states may trigger different deadlines and requirements
- Keep insurer-approved vendors (forensics, legal, PR) on a pre-identified list before an incident happens, since policies often require using approved providers
What NOT to Do
- Don't delay notification while you "figure everything out"—most laws require timely action even with incomplete information
- Don't speculate publicly about cause or scope before facts are confirmed
- Don't wipe or rebuild systems before forensic evidence is captured
- Don't notify only some affected individuals while investigation continues—plan for phased or supplemental notices if needed
- Don't skip legal review of notification language, even under time pressure