How to Respond to a Data Breach

Your first task in the event of a breach is to seal the security hole. This will prevent further breaches via the same route. Then investigate the causes.

• Secure any physical areas associated with the breach. For instance, if there was a physical break-in, change the door access codes as soon as possible. 
• Take all affected systems offline immediately, but don’t turn them off until forensic experts can investigate them.
• Build an Incident Response team. Your team could include experts from a range of disciplines. You may need to hire an independent forensics investigator and involve legal, information security, and even human resources. Professional Incident Response specialists can provide essential expertise.
• Capture a forensic image of the breach and collect evidence.
• Consult with your legal team. A cyber breach will often have contractual and data protection law consequences, so knowing your position here is essential.
• Replace offline machines with clean ones, if possible, but update all credentials in case these were the cause of the breach.
• If your website has been altered, immediately remove any unwanted information and contact search engines to remove the altered pages from their caches.
• Search other sites in case your information has been posted publicly elsewhere.
• Interview those who discovered the breach to help track down the cause.

Throughout this process, make sure you haven’t destroyed any evidence—you will need this to pinpoint the cause of the breach, fix the problem, and ascertain the damage to remediate.

Once you have tracked down the origin and pathway of the breach through your systems, the next step is to remove all the vulnerabilities that led to it.

• Were your service providers involved in the breach? If so, analyze what personal information they have access to and change their privileges if necessary.
• Work with your service providers to ensure their security is at the level you need.
• If your existing network segmentation did not provide the overall protection you had hoped for, consider changing how your network is segmented for greater resilience.
• Your forensic analysis should have revealed if your intended protective measures were functional. Was encryption enabled, and were backups being performed as scheduled?
• Once you have determined who had access to data involved in the breach, check their permissions and whether these are necessary. If not, impose measures to limit access more strictly.
• Get ready to communicate the facts about the breach to all stakeholders, from employees to customers and investors. 

As you are fixing the problem, consider the questions that will be asked about the breach and publish answers to key questions on your website to keep the situation as transparent as possible.

Fixing the cause of the breach is the most critical step for avoiding a recurrence, but there are likely to be repercussions that will require further remediation.

• There may be legal requirements regarding the notification of cyber breaches involving personal information, which vary by country and even by US state.
• Punitive costs may be involved with personal data loss in some jurisdictions.
• Contact law enforcement, reporting the situation and any implications for potential identity theft. You may also need to contact local intelligence agencies, such as the FBI in the US.
• If the breach involved health records, you might need to notify specific organizations, such as the Federal Trade Commission. You may also need to contact the media.
• For data thefts involving financial information, contact the businesses that maintain the affected accounts, such as credit card companies.
• Notify other affected parties, including individuals. Provide remedial services such as toll-free numbers for these parties to use for contact and free credit monitoring to track if their identity has been used nefariously.

Once you have followed these steps, you should be well on your way to preventing another breach of the same type and remediating the results of this one. For a more detailed list of specific rules regarding the notification of affected parties, see the FTC’s guide to a data breach response.

There are numerous causes of a security breach. Increasingly, WFH and hybrid work are leading to more devices and employees with access to important corporate resources operating unprotected by traditional perimeter-based network security. Hybrid working has also led to more personal devices (via BYOD) being used on internal networks, as hybrid workers bring their personal equipment into the office. Both these trends widen the threat domain—and cybercriminals are taking advantage. 

However, these factors merely amplify the existing causes of a cyber breach.

Malicious Insider

An employee has harmful intent and uses their access to create a security breach.

Lost or Stolen Device

A device that has access or contains sensitive information is lost or stolen.

Malicious Outsiders

Threat actors employ cyberattack vectors to gain security information from systems or individuals.

Weak Endpoint Security

Malicious outsiders find vulnerable endpoints, such as unpatched devices, old software, or poor implementation of authentication protocols.