The First 24 to 72 Hours After a Data Breach

Phase One: Secure Your Operations

The FTC’s Data Breach Response Guide for Business opens with securing your operations, not investigating the full scope yet. That means assembling a response team (forensics, legal, IT, operations, HR, and communications, with management involved), securing the physical areas connected to the breach, and taking affected equipment offline without destroying evidence in the process. If anything was posted publicly that should not have been, the guide also calls for working to remove it from your site and from search engine caches.

Why “Don’t Destroy Evidence” Is Not Just a Formality

A natural instinct is to power everything down immediately. The problem is that volatile data, things like active memory, running processes, and open network connections, disappears the moment a machine shuts off. A forensics team needs that data to reconstruct what actually happened. The FTC guide’s language reflects this: secure things quickly, but do it in a way that preserves what investigators will need next.

Phase Two: Fix Vulnerabilities

Once things are contained, the work shifts to working with your forensics team to analyze backup and preserved data, confirm whether network segmentation held, check which service providers had access and why, verify the status of your encryption, and review who had legitimate access to the affected systems. This is also when you start planning how and when you will communicate with employees, customers, investors, and partners.

Phase Three: Notify

The final phase is determining your legal notification obligations under state and federal law, notifying law enforcement where appropriate, and notifying affected businesses, credit bureaus, and individuals. The FTC guide includes a model notification letter covering what happened, what data was involved, what you are doing about it, and what the recipient should do next. Your state’s specific notification timeline is covered in Data Breach Notification Requirements by State.

If You Have Cyber Insurance

Most of this is run by your breach coach and forensics team once you report the incident, not by you alone. The sooner you report to your insurer, the sooner that team is in place. See How to File a Cyber Insurance Claim for what reporting the incident actually looks like.