What to Do After a Data Breach: A Step-by-Step Response Plan for Small Businesses

This is general information, not legal, tax, financial, medical or security advice. Rules and prices change, so confirm details with the official sources linked below or a qualified professional.

After a data breach, a small business should act in this order: contain the incident without destroying evidence, bring in help (IT or forensics, legal counsel, your insurer and your bank if money moved), figure out what data was affected and whose, meet your legal notification obligations, communicate clearly with the people affected, and then fix the root cause. The first hours matter most, especially if a fraudulent payment was made.

This guide follows the FTC's Data Breach Response: A Guide for Business, with notes for businesses serving customers outside the US.

This is general information, not legal advice. Breach notification laws vary by jurisdiction and data type; consult a lawyer with privacy expertise.

Key takeaways

• Contain, but preserve evidence. Take affected systems offline, but don't wipe or switch off machines until forensic experts advise.
• Call your bank immediately if money moved. Then report to the FBI's IC3.
• Every US state has a breach notification law, plus DC, Puerto Rico and the US Virgin Islands, according to the FTC.
• Other countries set strict clocks. Malaysia requires notifying its regulator within 72 hours for notifiable breaches.
• Tell people clearly what happened and what to do, and how you'll contact them, so scammers can't exploit the confusion.

The first 24 hours: step-by-step

1. Don't panic, and don't start deleting things. Evidence such as logs, emails and suspicious files will be needed to understand what happened.
2. Contain the damage. The FTC advises taking affected equipment offline immediately but not turning machines off until forensic experts arrive. Disconnect compromised devices from the network, and if possible put clean machines in their place.
3. Change compromised credentials. Reset passwords and sign out sessions for affected accounts from a known-clean device. The FTC warns that if a hacker stole credentials, your system remains vulnerable until you change them, even after removing the hacker's tools. Check for new MFA methods, email forwarding rules and connected apps.
4. If money was sent, call your bank's fraud team now. Ask them to attempt a recall and contact the receiving bank. Then file a complaint at ic3.gov. Speed matters in fund recovery.
5. Assemble your response team. Depending on size, the FTC lists forensics, legal, information security, IT, operations, HR, communications and management. For a small business this may be you, your IT provider, a lawyer and your cyber insurer.
6. Call your cyber insurer if you have a policy, before hiring outside firms. Check whether your policy requires prior notice or the use of approved vendors.
7. Start an incident log: what happened, when you discovered it, every action taken and by whom. You'll need it for regulators, insurers and your own review.
8. Secure physical areas if the breach involved offices, laptops or paper records.

Special case: business email compromise

If the incident is a fraudulent payment triggered by a fake or hijacked email, the FBI's 2025 report shows why speed matters: business email compromise caused $3.05 billion in reported losses that year. Alongside the steps above:

• Give your bank the exact amount, date, destination account and the fraudulent instructions.
• Check the compromised mailbox for forwarding rules, deleted items and sent messages to other customers or suppliers.
• Warn customers and suppliers who may receive fake invoices from your account, using a channel other than that mailbox.
• Keep the original emails with full headers; investigators and your bank may need them.

Days 2 to 7: investigate and fix

Bring in forensics

The FTC suggests considering independent forensic investigators to determine the source and scope of the breach. They capture forensic images of affected systems, collect and analyze evidence, and outline remediation steps.

Answer the key questions

• What systems and accounts were accessed?
• What types of data were exposed: names, emails, passwords, financial data, government ID numbers, health information?
• Whose data was it: customers, employees, partners? Where do they live?
• Was the data encrypted?
• Is the attacker still present?

Fix the vulnerabilities

The FTC's guidance highlights several areas to check:

• Service providers. Review what personal data they can access, change privileges if needed, and verify any fixes they claim.
• Network segmentation. Check whether a breach on one system could spread to others.
• Access. Review logs to see who had access during the breach, who has access now, and remove access that isn't needed.
• Encryption. Confirm whether data was encrypted at the time.

Remove exposed information

If personal information was posted on your website by mistake, remove it immediately, and contact search engines about cached copies. Search for copies on other sites and ask them to take it down.

Notification: who you may need to tell

Notes for businesses outside the US

If you or your customers are outside the US, local law may impose tighter deadlines:

• Malaysia. Under section 12B of the Personal Data Protection Act and the Commissioner's Data Breach Notification Guideline, in force since June 1, 2025, data controllers must notify the Personal Data Protection Commissioner as soon as practicable and no later than 72 hours for notifiable breaches. A breach is notifiable if it causes or is likely to cause significant harm, or affects more than 1,000 people. Where significant harm is likely, affected individuals must be told without unnecessary delay and no later than seven days after the initial notice to the Commissioner.
• Other jurisdictions. If you serve customers in the EU, UK, UAE, Pakistan or elsewhere, ask counsel which laws apply. A US LLC serving international customers may be subject to the rules where those customers live.

Communicating with the people affected

The FTC recommends designating a single point person for releasing information and considering letters, a website page and a toll-free number. Its model notification letter covers:

• What happened, including the date and how it occurred
• What information was involved
• What you are doing, including any free credit monitoring or identity restoration services
• What they can do, such as placing a fraud alert or credit freeze, with contact details
• How you will contact them in the future, which helps them avoid follow-up phishing scams

Don't make misleading statements or withhold details that would help people protect themselves, and don't publish information that puts them at further risk. Put clear answers to likely questions on your website.

From experience. For healthtech systems like Movo-X, the clinic operating system we build in Malaysia, I recommend writing the incident contact list and the "who decides what" section of the plan before anything goes wrong. In a real incident, nobody should be looking up the lawyer's number or debating who approves a customer email.

Recover and learn

1. Restore from clean backups, not from systems that may still be compromised. See the 3-2-1 backup strategy.
2. Rebuild affected devices rather than trusting a cleanup when in doubt.
3. Rotate all secrets that could have been exposed: passwords, API keys, tokens and certificates. See API keys and secrets management.
4. Hold a short post-incident review: root cause, what worked, what was slow, and three improvements with owners and dates.
5. Update your security checklist and incident plan.

Incident response checklist

• [ ] Affected devices disconnected; evidence preserved
• [ ] Compromised credentials reset; sessions revoked; MFA and mail rules checked
• [ ] Bank fraud team called (if funds moved); IC3 complaint filed
• [ ] Response team assembled: IT/forensics, legal, insurer, management
• [ ] Incident log started and maintained
• [ ] Scope determined: systems, data types, affected people and locations
• [ ] Legal notification obligations identified and deadlines calendared
• [ ] Law enforcement contacted; notice timing coordinated
• [ ] Notification letters, web page and contact point prepared
• [ ] Vulnerabilities fixed; service providers reviewed
• [ ] Systems restored from clean backups; secrets rotated
• [ ] Post-incident review completed; plan updated

Next steps

• Write a one-page incident plan now with phone numbers for your bank's fraud team, IT support, a privacy lawyer and your insurer.
• Make sure you can restore from backups that attackers can't reach.
• Reduce the odds of a repeat with the small business cybersecurity checklist and phishing protection for small teams.
• If a breach raises questions from investors or acquirers, our technical due diligence service can assess your security posture. For urgent help, contact us.

Sources

• FTC, Data Breach Response: A Guide for Business: https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business
• FBI IC3, 2025 Internet Crime Report: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
• CISA, #StopRansomware Guide: https://www.cisa.gov/stopransomware/ransomware-guide
• Personal Data Protection Commissioner Malaysia, Data Breach Notification Guideline: https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_DBN_ENG.pdf
• NIST SP 1300, CSF 2.0 Small Business Quick-Start Guide: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf

Keep reading