A breach rarely arrives with sirens. More often it shows up as a strange login from an unfamiliar country, an invoice a customer never received, or an email from a researcher at 11 p.m. on a Friday. What happens next is less about heroics and more about discipline: the first 48 hours set the factual record, the legal exposure, and the tone of every conversation that follows.
You do not need to know everything yet. You do need to stop the bleeding, preserve what you have, and get the right people on the phone. Here is how that looks in practice.
Hour Zero to Two: Contain the Damage Without Erasing the Evidence
Containment and investigation pull in opposite directions. Rebuilding a server feels decisive; it also destroys the timeline you will need for regulators, insurers, and your own lawyers. Isolate affected systems from the network, revoke compromised credentials, rotate API keys and tokens, and block the source of the intrusion. Then pause before you wipe anything.
Three habits separate a manageable incident from a mess:
- Write down decisions as you make them. Note the time, who decided, what triggered the decision, and what you expected to happen. A simple shared document beats a flawless memory six weeks later.
- Preserve before you patch. Take forensic images of affected machines and export relevant logs, including authentication, VPN, email gateway, and cloud audit trails. Many platforms retain logs for a limited window, so export early.
- Resist restoring from backup immediately. A clean restore may reintroduce the vulnerability or overwrite evidence of how the attacker got in.
If ransomware is involved, do not negotiate or pay without advice. In some jurisdictions, payments to sanctioned groups can expose a company to serious legal risk, and payment does not guarantee recovery.
Build the Room: Counsel, Forensics, and Your Insurer
Within the first day, you want four parties engaged: outside counsel experienced in data incidents, a digital forensics firm, your insurance broker or carrier, and whoever owns communications. Loop in your internal security lead, but avoid making the incident a company-wide email topic.
Two practical points teams often miss. First, notify your cyber insurer as soon as the policy requires it. Late notice is one of the most common reasons claims get trimmed, and many policies require you to use pre-approved vendors. Second, consider retaining the forensic firm through outside counsel. In the United States, having counsel direct the investigation can help bring the resulting reports under attorney-client privilege or work product protection. That protection is not absolute, and courts in some countries take a narrower view, so treat privilege as a goal to protect rather than a guarantee. Do not circulate the forensic report casually; a leaked draft can waive the protection you were counting on.
Pin Down the Facts That Trigger Legal Duties
Most notification laws care about a specific question: was personal data involved, and what kind? A breach of internal project files may be a security problem; a breach involving health records, financial account details, government identifiers, or credentials carries obligations.
By the end of the first day, aim to answer these:
- What systems were accessed, and for how long?
- What categories of data were stored there, and whose data was it — customers, employees, patients, minors?
- Was data exfiltrated, or only accessible? Evidence of copying matters legally.
- Are you a controller, a processor, or both for the affected data? That changes who notifies whom.
- Which contracts require you to inform a client within a set number of hours?
Where you genuinely do not know yet, document your uncertainty and the steps you are taking to resolve it. Regulators tend to be harder on organisations that cannot show a process than on ones that say plainly what they did not yet know.
Know Which Clocks Are Running
Deadlines overlap, and the shortest one governs. Treat the following as a map, not legal advice — the specifics depend on your jurisdiction, sector, and the data involved.
- EU and UK data protection rules. Where a breach is likely to risk people's rights, regulators generally expect notification within 72 hours of becoming aware, with individuals informed without undue delay when the risk is high.
- US state laws. Nearly every state has its own breach notification statute, with varying triggers and timelines, and some require notice to the state attorney general as well as to residents.
- Sector regulators. Health, financial services, telecoms, and education operate under their own regimes, sometimes with tighter clocks and specific reporting forms.
- Public companies. Listed issuers may face securities disclosure duties on a short timeline once an incident is determined to be material.
- Contractual and industry duties. Payment card rules, data processing agreements, and enterprise customer contracts frequently impose notification windows measured in hours or days.
- Law enforcement. Reporting to police or a national cybercrime unit can be required, advisable, or strategically useful — and occasionally comes with a request to delay public notice.
Because these duties stack, build one master timeline with the earliest applicable date for each audience and work backwards. If a deadline will be missed, notify anyway and explain the delay; silence is worse than a late filing.
Notify in Order — and Choose Words Carefully
Sequence usually goes: insurer and counsel, then regulators, then affected individuals, then partners and the public. Individual notices should say what happened, what data was involved, what you are doing, and what people can do — such as changing passwords or watching for phishing that references the incident.
Write less than you know, but never write something you cannot support. Avoid naming a culprit, estimating the number of affected people, or describing the cause until forensics confirms it. Inconsistency across a regulator filing, a customer email, and a press statement is the fastest way to turn an incident into an investigation of your handling of it.
Close the First 48 Hours With a Written Record
Before people go home, produce a short internal summary: confirmed facts, open questions, decisions taken, notifications made or scheduled, and next steps with owners and times. Keep privileged material separate from the operational record. This document becomes the spine of everything you file, say, and claim in the weeks ahead.
What to Do Before the Next Breach
The organisations that handle incidents well are usually the ones that decided who to call before they needed to. Keep a signed retainer with a forensics firm. Store your insurer's notification number somewhere other than the systems you may lose access to. Run a tabletop exercise once a year with legal, security, communications, and leadership in the same room, and practise the awkward parts: who calls the regulator, who drafts the customer email, who tells the board.
And when a real incident lands, get professional legal advice early. The facts will change hour by hour, and the notification rules that apply to you depend on details only a lawyer familiar with your jurisdiction and industry can weigh properly.
Photo: Wolfgang Weiser / Pexels
