Key takeaway
Facts are incomplete in the first alert. Mark assumptions, preserve evidence, assign owners and confirm notification duties with qualified counsel.
Give leaders and responders one shared picture
When a breach is suspected, appoint an incident lead and bring together security, IT, legal, privacy, communications and affected business teams. The first update should state observed facts, what remains unknown, potentially affected systems and when the next update will come. Leaders decide on continuity, resources and communications while technical teams establish evidence and scope.
Contain the incident and preserve evidence
Identify affected accounts, devices and services; revoke access, isolate a suspected host and close the attack path where needed. Preserve logs, email headers, authentication and network records, change history and timestamps. Coordinate cleanup and recovery with evidence collection so changes do not undermine the investigation. Do not declare systems safe before the scope is known.
Plan notification, recovery and review
Determine which data, people and systems were affected. With legal and privacy owners, confirm who must be notified and when under applicable law, contracts and regulatory duties; do not guess deadlines. Give affected people verified facts, practical steps and a help channel. Restore data and services from trusted backups, refresh credentials and verify recovery.
Report impact and decisions to leaders
Executive updates should cover operational disruption, data and customer impact, a cost estimate with its basis and uncertainty, unresolved risks and decision owners. Alongside technical measures, report return to work, supplier dependencies and staff support. Afterward, document the cause, missed signals, control gaps and agreed actions with owners and dates; the goal is to improve the next response.