What to Do After a Data Breach: A First-72-Hours Guide for Small Businesses

Stay calm and start a log

The first hours after discovering a breach feel chaotic. Resist the urge to fix everything at once. Start a simple written log with the time, what you noticed, who you told and what you did. Those notes will help investigators, insurers, lawyers and regulators, and they stop you relying on memory when stress is high.

Name one person to lead. Without a leader, small teams tend to duplicate work, change things that should be left alone or forget to tell the people who need to know.

Step one: contain it

Containment limits further harm without destroying evidence. The details depend on what happened, but the principle is to stop the attacker and prevent further loss.

• Disconnect affected devices from the network rather than turning them off, if you can
• Change passwords and revoke sessions for compromised accounts, starting with email and admin accounts
• Disable suspicious accounts, remote access and unneeded integrations
• Do not wipe or reinstall systems until evidence has been captured
• Keep communications about the incident off possibly compromised email if you can

Step two: find out what was affected

Work out which systems, accounts and data were involved, and which people the data relates to. Ask what type of data it was: names and email addresses carry different risk from payment details, health information or identity documents. Check logs, sign-in history and mailbox rules if you can, or ask your IT provider to do so.

You may not have complete answers quickly, and that is normal. Record what you know, what you suspect and what you still need to learn. Avoid making public statements that you later have to correct.

Step three: get help and check your duties

Call your IT provider or an incident response specialist, and contact your insurer if you have a policy. Speak to a lawyer or data protection adviser about notification duties. Rules vary: under the GDPR, for example, breaches that are likely to result in a risk to individuals generally have to be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Other countries and US states have their own rules and timelines.

Contracts matter too. Customers, payment processors or partners may require you to notify them within a certain period. Gather your key contracts early so you know what you promised.

Step four: tell people clearly

When you notify customers or staff, write plainly. Say what happened, what information was involved, what you are doing about it and what they can do to protect themselves, such as changing passwords or watching for suspicious messages. Provide a contact point and avoid jargon or defensive language.

Prepare for questions by agreeing short answers in advance. If media or social channels become involved, designate one spokesperson. Honesty tends to preserve trust better than minimising a problem that later turns out to be larger.

Step five: fix the cause and learn

After the immediate danger has passed, find the root cause. Was it a phished password, an unpatched system, an exposed service or a mistake with permissions? Close that route, then look for similar weaknesses elsewhere. Restore systems from known clean backups, rotate credentials and monitor closely for repeat activity.

Hold a short review within a few weeks. Update your incident plan, your training and your technical controls based on what you learned. Keep the incident log and evidence for as long as your adviser recommends.

A short template for your own plan

You can turn this guide into a one-page plan today. Write down the name and phone number of the incident lead and a deputy. List who to call for IT, legal advice, insurance and your bank. Note where your most important data lives and who administers each system. Add the key regulatory contacts for your country and sector, and record the deadlines you are aware of.

Print it and store a copy off-site. If your email and shared drive are the very things that failed, a plan that lives only inside them will not help. Review the page every six months and after any staff change. Run a thirty-minute walkthrough with the team once a year, using a simple scenario such as a stolen laptop or a compromised mailbox, and see where the plan has gaps.

Prepare before it happens

A tiny amount of preparation makes a large difference. Keep a one-page contact sheet with your IT provider, insurer, lawyer and bank, stored somewhere you can reach if email is down. Know where your data lives and who is responsible for each system. Turn on multi-factor authentication and logging now, because logs that were never enabled cannot be recovered after an incident.