What to Do in the First 24 Hours After a Data Breach
The first day after a breach shapes everything that follows. A calm, ordered plan: contain, call the right people, preserve evidence, and recover safely.
In the first 24 hours after a suspected breach, focus on five things in order: contain the incident by isolating affected systems from the network without wiping them, notify your cyber insurance carrier and legal counsel early, preserve evidence such as logs and affected devices, reset compromised credentials from a clean device, and document every action with times. Avoid rushing to rebuild or delete systems before you understand what happened, because that destroys evidence and can leave the attacker's access in place.
This guide is general operational guidance, not legal advice. Notification obligations vary by situation and jurisdiction, so involve qualified legal counsel and review applicable regulations.
Hour 0 to 1: Confirm and contain
Recognize the signs
Common indicators include ransom notes, files that will not open, unexpected password reset emails, clients reporting strange messages from your address, security alerts from your EDR or Microsoft 365, or unusual payments.
Isolate, do not power off
- Disconnect affected computers from the network by unplugging the cable or disabling Wi-Fi.
- Leave them powered on if possible, since memory can hold evidence that disappears on shutdown.
- If ransomware is spreading, consider disconnecting the office internet connection or isolating network segments.
- Do not run cleanup tools, reinstall the operating system, or delete suspicious files yet.
Activate your response team
Bring in your internal lead, your IT provider, and leadership. If you have an incident response plan, follow it. If you do not, this article can serve as a starting outline.
Hour 1 to 4: Make the right calls
| Who to contact | Why |
|---|---|
| Cyber insurance carrier | Many policies require prompt notice and may assign approved responders |
| Legal counsel | Guides notification obligations and helps protect privileged communications |
| IT provider or incident response firm | Technical containment and investigation |
| Bank | If payments or accounts may be affected, ask about stopping or recalling transfers |
| Law enforcement | You can report cybercrime to the FBI through IC3 (ic3.gov) |
Call your insurance carrier before hiring outside responders on your own, since coverage may depend on using approved vendors. Use phone calls or a separate, unaffected communication channel if you suspect email is compromised.
Hour 4 to 12: Preserve evidence and cut off access
Preserve
- Export or protect logs from firewalls, servers, Microsoft 365 or Google Workspace, VPNs, and EDR tools before they roll over.
- Take photos of ransom notes and error messages.
- Keep affected devices as they are until investigators advise otherwise.
- Save suspicious emails as attachments rather than deleting them.
Cut off attacker access
- Reset passwords for affected accounts, administrators, and service accounts from a known-clean device.
- Revoke active sessions and tokens in Microsoft 365 or Google Workspace.
- Review and remove unfamiliar mailbox forwarding rules, OAuth app consents, and newly created accounts.
- Disable remote access tools that are not essential, and require MFA on everything that remains.
- Check firewall rules and port forwards for recent changes.
Hour 12 to 24: Assess and plan recovery
Understand scope
Work with your responders to answer key questions: which systems were affected, what data may have been accessed or taken, how the attacker got in, and whether they still have access. Answers may take longer than a day, which is normal.
Check your backups
Confirm that backups are intact and were not reached by the attacker. Immutable or offline copies are especially valuable now. Do not restore into an environment until the entry point is closed, or the attacker may return.
Communicate carefully
- Give staff clear instructions: what to use, what to avoid, and whom to ask.
- Prepare holding statements for clients if needed, reviewed by legal counsel.
- Do not speculate publicly about cause or scope before the facts are known.
Keep a timeline
Record every action, who did it, and when. This log supports insurance claims, legal decisions, and your own post-incident review.
After the first day
Recovery continues with eradication, restoring from clean backups, hardening, and a lessons-learned review. Typical improvements include MFA everywhere, EDR coverage, offline backups, and an incident response plan tested at least once a year.
Our cybersecurity services include incident response support and post-incident hardening, and managed IT support provides continuous monitoring to help detect problems earlier.
FAQ
Should we shut down all computers right away?
Isolating from the network is usually better than powering off, because it stops spread while preserving evidence in memory. Follow your incident responders' guidance for your specific situation.
Do we have to notify customers?
It depends on the data involved, where affected individuals live, and the regulations that apply to your business. Consult legal counsel and review applicable regulations promptly, since some requirements have deadlines.
Can we handle a breach ourselves?
Small incidents may be manageable with a capable IT provider, but involving your insurer, legal counsel, and experienced responders early helps protect the business and avoids costly mistakes.
Next step
The best time to plan for an incident is before one happens. Max, our founder, has worked in IT since 1999 and holds CompTIA Security+. Request a free IT assessment and we will help you build a practical incident response plan and verify that your backups and MFA are ready.
