What to Do After a Data Breach: The Complete Response and Claims Guide

The First Move: Secure, Then Investigate

The FTC’s official Data Breach Response Guide for Business lays out the process in three phases: secure your operations, fix vulnerabilities, and notify the appropriate parties. The guide’s first instruction matters more than it sounds: move quickly to secure systems and assemble your response team, but do not destroy evidence while doing it. Taking a compromised server offline before forensics has captured what is running on it can erase the exact information you need to figure out what happened and what you are legally required to disclose.

See the hour-by-hour version of this in The First 24 to 72 Hours After a Data Breach.

Who Actually Shows Up to Help

If you have cyber liability insurance, you are not handling this alone. Your insurer typically assigns a breach coach, a privacy attorney from the carrier’s panel who directs the response, sets notification deadlines, and structures the engagement so the investigation falls under attorney-client privilege. The breach coach brings in a forensics firm and, if needed, a PR or crisis communications firm. Full roles in Who Is On Your Incident Response Team?

How the Claims Process Actually Works

Most policies require first notice of loss (FNOL) within 24 to 72 hours of discovering an incident. From there, the insurer assigns an adjuster and breach coach, forensics scopes the incident, notification obligations get determined and executed, and you submit a proof of loss with documentation before a final coverage decision. The full sequence is in How to File a Cyber Insurance Claim, and what the forensics team is actually doing during that window is in The Forensic Investigation Process.

Your Notification Obligations Depend on Your State

All 50 states have their own data breach notification laws, with different timelines, different definitions of what counts as personal information, and different triggers for notifying a state attorney general versus just affected individuals. See Data Breach Notification Requirements by State for links to the specific law in each state we serve.

Why Claims Get Delayed or Denied

Coverage disputes are real, and they tend to cluster around a few patterns: material misrepresentation on the original application (claiming you had MFA when you did not), using a vendor your insurer did not approve, and reporting an incident late under a claims-made-and-reported policy. See Why Cyber Insurance Claims Get Delayed or Denied for the detail, including why timing matters so much.

Business Interruption Is Its Own Claim

If a breach takes your systems down, the income you lose during that downtime is typically handled as a separate business interruption claim, calculated against your own pre-incident revenue and expenses, not a flat industry number. Full breakdown in Business Interruption Claims After a Cyber Incident.

Do You Have to Call the FBI?

No federal law requires it for most businesses, though some state or sector-specific rules may apply separately. The FBI’s Internet Crime Complaint Center (IC3) strongly encourages reporting, but filing a complaint is voluntary. More in Working With Law Enforcement After a Cyber Incident.

You Do Not Have to Figure This Out Alone

This is exactly what a cyber liability policy is built to activate: a breach coach, a forensics firm, and a claims process that already knows the rules, instead of you learning them for the first time under pressure. If you are not currently covered, get a quote before you need any of this.

Every Response Question, Answered