Data breach response plan: Key steps and common pitfalls

One breach we have responded to started with a single mailbox. An attacker had taken over a staff email account and was using it to message the people that account normally talked to. Our response came down to four moves: contain the account, remove the attacker’s inbox rules, warn the contacts who may have received fraudulent messages, and review what the attacker could read. That order is the backbone of a good data breach response plan, whatever the incident.

Most of the damage in a breach comes from slow or messy response. IBM’s 2026 Cost of a Data Breach Report puts the average US breach at $11.5 million. Your numbers will be smaller, but the pattern holds: the longer it takes to find and contain, the more it costs.

Step 1: Contain without destroying evidence

The urge is to wipe the infected computer and get back to work. The FTC’s breach response guide says to take affected equipment offline right away, but not to turn machines off until forensic experts arrive, and not to destroy forensic evidence.

• 01Disconnect affected devices from the network and leave them powered on.
• 02Reset passwords, revoke active sessions, confirm MFA is on, and remove any mailbox rules, forwarding, app consents or new MFA methods the attacker added.
• 03Check other accounts and servers that share credentials or access with the affected system.
• 04Export sign-in, email and firewall logs before they roll over.
• 05Start a written timeline: when the problem was found, by whom, and every action since.

Step 2: Make the calls in the right order

The FTC recommends a response team that can include forensics specialists, legal counsel, IT, operations, HR and communications. For a smaller organization, that means a handful of calls in a specific order.

1. Your cyber insurer’s breach hotline. Many policies require their approved forensic and legal firms, and hiring your own first can leave those costs unreimbursed.
2. A lawyer with privacy experience, who can work out which notification laws apply and direct the investigation in a way that may protect privileged findings.
3. Your IT provider, to start containment while the forensic team is engaged.
4. The FBI through IC3, especially if money was wired, since fast reporting gives banks the best chance of recalling funds.
5. Your bank, if account details, payroll or wire transfers were involved.

Keep your insurer’s hotline and your IT contact somewhere other than your email. A breach is a bad time to search an inbox you can’t trust. Our guide to what cyber insurance really covers explains why the insurer comes first.

Step 3: Find out what was accessed

Notification decisions depend on what the attacker could see, so this step can’t be skipped. In a mailbox takeover, that means reviewing sign-in history, the messages and attachments the attacker could open, and what was sent from the account. Logs make this possible. Without them, you may have to assume the worst and notify everyone. Our email sign-in monitoring has caught real takeover attempts at clients and contained the accounts within the hour, which keeps this review short.

Step 4: Meet the notification deadlines

The rules depend on where affected people live and what industry you are in. Your lawyer makes the final call, but these are the ones Louisiana organizations meet most often.

If a vendor that holds your data is breached, Louisiana law requires it to notify you. The Safeguards Rule also requires a written incident response plan, so the plan itself is a compliance item. See our page on IT and compliance for healthcare practices for the HIPAA side.

Step 5: Communicate without making it worse

• Say what you know, what you are doing and when you will update people. Early claims like “no data was taken” often turn out to be wrong.
• Use plain language about what happened, what was involved and what people should do next.
• If the attacker had your mailbox, coordinate by phone or a separate account.
• Give staff a short script and tell them where to send questions they can’t answer.
• Keep a record of every notice sent, to whom and when.

Data breach response pitfalls that raise the cost

• Waiting to see if it’s real. Delay adds cost and eats into notice windows that start at discovery.
• Wiping before investigating, which destroys the record of what was accessed.
• Fixing the device and leaving the account. A stolen password or session token still works.
• Forgetting vendors, client contracts and your insurer, which may have their own notice terms.
• Skipping the review. Attackers often come back through the same door.

If the breach notice comes from a company you use, change that password and any reused copies, turn on MFA, and expect more phishing. A password manager makes unique passwords practical, and dark web monitoring tells you when staff logins leak. If Social Security numbers were exposed, the FTC notes a credit freeze with Equifax, Experian and TransUnion is free and doesn’t affect your score.

For our clients, part of the response is in place before anything happens: a 24/7 security operations center that can isolate a compromised device. So far, none of our clients has had a reportable data breach. Our cybersecurity services, business continuity planning and compliance services cover the pieces. Book a 15-minute call to check your plan against the Louisiana, HIPAA and FTC deadlines that apply to you.

Frequently asked questions