As specified by the Federal Trade Commission

and demonstrated by Sony,


Heartland Payment Systems,

and Equifax.

You just learned that your business experienced a data breach.

What steps should you take and whom should you contact if personal information may have been exposed?

This guide addresses the steps to take once a breach has occurred.

Secure Your Operations

The only thing worse than a data breach is multiple data breaches.

Take steps so it doesn’t happen again.

Mobilize your breach response team right away to prevent additional data loss.

The exact steps to take depend on the nature of the breach and the structure of your business.

Assemble a team of experts to conduct a comprehensive breach response.

Identify a data forensics team.

Consider hiring independent forensic investigators to help you determine the source and scope of the breach.

They will capture forensic images of affected systems, collect and analyze evidence, and outline remediation steps.

Consult with legal counsel.

Talk to your legal counsel.

Then, you may consider hiring outside legal counsel with privacy and data security expertise.

They can advise you on federal and state laws that may be implicated by a breach.

Secure physical areas potentially related to the breach.

Lock them and change access codes, if needed.

Ask your forensics experts and law enforcement when it is reasonable to resume regular operations.

Stop additional data loss.

Take all affected equipment offline immediately— but don’t turn any machines off until the forensic experts arrive.

Closely monitor all entry and exit points, especially those involved in the breach.

If possible, put clean machines online in place of affected ones.

In addition, update credentials and passwords of authorized users.

Stop additional data loss.

If a hacker stole credentials, your system will remain vulnerable until you change those credentials, even if you’ve removed the hacker’s tools.

Remove improperly posted information from the web.

Your website: If the data breach involved personal information improperly posted on your website, immediately remove it.

Be aware that internet search engines store, or “cache,” information for a period of time.

You can contact the search engines to ensure that they don’t archive personal information posted in error.

Other websites: Search for your company’s exposed data to make sure that no other websites have saved a copy.

If you find any, contact those sites and ask them to remove it.

Interview people who discovered the breach.

Also, talk with anyone else who may know about it.

If you have a customer service center, make sure the staff knows where to forward information that may aid your investigation of the breach.

Document your investigation.

Do not destroy evidence.

Don’t destroy any forensic evidence in the course of your investigation and remediation.

Fix Vulnerabilities

Think about service providers.

If service providers were involved, examine what personal information they can access and decide if you need to change their access privileges.

Also, ensure your service providers are taking the necessary steps to make sure another breach does not occur.

If your service providers say they have remedied vulnerabilities, verify that they really fixed things.

Check your network segmentation.

When you set up your network, you likely segmented it so that a breach on one server or in one site could not lead to a breach on another server or site.

Work with your forensics experts to analyze whether your segmentation plan was effective in containing the breach.

If you need to make any changes, do so now.

Work with your forensics experts.

Find out if measures such as encryption were enabled when the breach happened.

Analyze backup or preserved data.

Review logs to determine who had access to the data at the time of the breach.

Also, analyze who currently has access, determine whether that access is needed, and restrict access if it is not.

Verify the types of information compromised, the number of people affected, and whether you have contact information for those people.

When you get the forensic reports, take the recommended remedial measures as soon as possible.

Have a communications plan.

Create a comprehensive plan that reaches all a ected audiences — employees, customers, investors, business partners, and other stakeholders.

Don’t make misleading statements about the breach.

And don’t withhold key details that might help consumers protect themselves and their information.

Also, don’t publicly share information that might put consumers at further risk.

Anticipate questions that people will ask.

Did the breach involve electronic health information?

Notify Individuals

People who are notified early can take steps to limit the damage.

consider offering at least a year of free credit monitoring or other support such as identity theft protection or identity restoration services, particularly if financial information or Social Security numbers were exposed.

When such information is exposed, thieves may use it to open new accounts.

Describe how you’ll contact consumers in the future.

For example, if you’ll only contact consumers by mail, then say so.

If you won’t ever call them about the breach, then let them know.

Call any one of the three major credit bureaus.

As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts.

The initial fraud alert stays on your credit report for 90 days.

You can renew it after 90 days.

Equifax: or 1-800-525-6285 Experian: or 1-888-397-3742 TransUnion: or 1-800-680-7289