What to do after a data breach

The Federal Trade Commission’s advice for the first hour of a breach fits in one line: take all affected equipment offline right away, but don’t turn any machines off until forensic experts arrive. Pull the network cable or switch off the Wi-Fi, leave the machines as they are, and then call your cyber insurer before you hire an IT firm, an investigator or a lawyer on your own.

Everything after that depends on what was exposed and whose data it was, and the FTC notes that every state, plus the District of Columbia, Puerto Rico and the Virgin Islands, has a law requiring notice of security breaches involving personal information, and those laws don’t match each other. The steps below follow the FTC’s order, with the insurance calls added where they belong.

The first hour: contain it, keep the evidence

A breach rarely announces itself as one. It might be a staff email account sending strange messages, a ransom note on the front desk computer, a vendor telling you your customer list turned up online, or a card processor reporting fraud traced back to your store.

1. Take affected devices offline. Unplug the network cable or turn off Wi-Fi on the affected computer, register or tablet, but leave it powered on.
2. Don’t wipe, reinstall or “clean up.” Deleting files or restoring from backup too early can erase the evidence of how the attacker got in and what they took.
3. Secure the physical space if devices, files or paperwork might have been taken.
4. Change passwords for affected accounts from a device you know is clean, starting with email, banking, payment and admin accounts, and turn on multi-factor sign-in where you can.
5. Write down what you know: when you noticed, what you saw, who found it and what you’ve done since. Screenshot any ransom note or suspicious message, and talk to whoever discovered the problem while it’s fresh.
6. Don’t pay a ransom or reply to the attacker before you’ve talked to your insurer and law enforcement.

Call your insurer before you call vendors

This is the order that saves money. If you have cyber insurance, call the insurer before you hire anyone, because many cyber policies give you access to a breach response team, often coordinated by a lawyer known as a breach coach, and some require you to use the insurer’s approved vendors or get consent before you incur costs. An IT firm you hired in a panic at midnight may do good work and still not be covered. Call first.

Cyber insurance typically helps pay for investigating the breach, notifying the people affected, restoring data and defending claims from people whose information was exposed, subject to the policy’s terms, limits, sublimitsSublimitA sublimit is a smaller cap within a policy’s overall limit that applies to one specific type of loss or coverage, and it doesn’t add to the overall limit.Read the definition and exclusions, and with Corgi, one claims specialist handles the claim from the first call until it’s closed.

When you call, have this ready:

• When and how you found the breach
• Which systems, accounts and devices seem to be affected
• What kinds of information they hold, such as customer names, card data, health records, Social Security numbers or client files
• Any ransom demand or message from the attacker
• What you’ve already done

Cyber policies usually cover both your own costs and claims against you, which first-party vs. third-party coverage explains. If you don’t have a cyber policy, read do small businesses need cyber insurance after the breach is handled, since a general liability policy typically won’t respond to a breach.

Who else needs a call?

The FTC’s guide says to put a breach response team together right away, and for a small business that usually means four calls beyond the insurer.

• Forensic investigators find out how the breach happened, what was taken and whether the attacker is still inside. The FTC suggests considering independent investigators, and your insurer may name approved ones.
• A lawyer with privacy experience works out who you have to tell. If your insurer assigns a breach coach, that’s usually your lawyer, so ask whether the policy pays for anyone else before you hire a second one.
• Law enforcement. The FTC says to call your local police right away and, if they aren’t familiar with this kind of case, the local office of the FBI or the U.S. Secret Service. Online crime can be reported to the FBI’s Internet Crime Complaint Center (IC3), and for ransomware, the Cybersecurity and Infrastructure Security Agency (CISA) says victims should report to federal law enforcement through IC3 or a Secret Service field office, and can ask CISA for technical help through its Stop Ransomware site.
• Your service providers. If a vendor was involved, like your booking software, point-of-sale provider or IT contractor, find out what access they had and what they’ve changed.

What was exposed decides what you owe

Your legal duty to notify people usually turns on a handful of facts that only the investigation can establish, and until you have them, nobody (your lawyer included) can tell you who you have to contact. So let the investigation finish, even though every instinct says to start sending emails.

The first fact is what kind of information was involved, because state laws define “personal information” as a list of specific data types, and the lists differ. Washington’s, as its attorney general describes it, covers a resident’s name combined with items such as a Social Security number, a driver’s license number, a financial account number with its access code, a full date of birth or medical data, and it also counts a username or email address paired with a password. Another state’s list may be shorter or longer, which is why a breach of names and emails alone can mean nothing to report in one place and a notice in another.

The second fact is whether the data was encrypted. Washington, for one, doesn’t require notice when the compromised information was encrypted, redacted or otherwise unreadable, though other states write that exception their own way. The third is whether the attacker only saw the data or copied it, the question a wiped machine can no longer answer. The fourth is where the affected people live, because each person’s own state law can apply, so a café taking online orders from three states may be working under three sets of rules at once, with different clocks: Washington’s is 30 days from discovery, and it requires a notice to the attorney general too when more than 500 residents are affected.

The last one owners tend to miss: whose data is it? If your office handles another business’s files, like a client’s employee records, the FTC says to notify that business, and if financial account numbers you don’t maintain were stolen, it says to tell the bank or card issuer so it can watch for fraud. If card data was involved, read your merchant agreement too, since card processors may set their own notice and investigation requirements, which is one more reason to call your insurer before you hire anyone.

Does health data change the rules?

Yes, and this is where a small business can get caught by a rule it has never heard of. Health data can bring in federal rules on top of the state ones: the FTC points to its own Health Breach Notification Rule and to HIPAA’s Breach Notification Rule, and which one applies, if either, depends on what kind of business you are and what data you hold.

What to tell the people affected

Before any notice goes out, the FTC says to talk with law enforcement about timing, so you don’t get in the way of an investigation. When you notify people, the FTC says to describe clearly what you know about the breach. Keep it plain. A good notice covers:

• How it happened, as far as you know
• What information was taken or exposed
• What you’ve done to fix the problem and protect them
• What they can do, such as watching their accounts, changing passwords or placing a fraud alert or credit freeze
• How to reach you with questions, and how you’ll contact them later, so they can spot scam messages pretending to be you

Pick one person to speak for the business, so customers don’t hear three versions of the story. The FTC also suggests considering at least a year of free credit monitoring or other support, especially when financial information or Social Security numbers were exposed, and if your cyber policy can help pay for it, that’s an easy call. It points victims to IdentityTheft.gov for recovery steps, and it’s blunt that you shouldn’t make misleading statements about the breach.

Fix the hole before you call it over

The crisis may feel over by now, but the investigators’ findings are your to-do list. Start at the top. Close the gap that let the attacker in, cut back what service providers can reach and confirm any fixes they say they’ve made, then turn on multi-factor sign-in for email, banking, payment and admin accounts. Keep backups offline or separate from your network and test that you can actually restore them, and train staff to spot phishing and invoice scams, since email scams and wire fraud covers the ones that hit small businesses most.

Then write a one-page plan: who to call first, where the insurer’s number is and which devices to pull off the network. It sounds too simple to matter. But the most expensive mistakes in a breach, like wiping the machines and hiring vendors before calling the insurer, happen in the first hour, when nobody has time to read a guide like this one.