A data breach response has two competing pressures: contain the risk quickly and preserve enough evidence to understand the incident. Acting too slowly increases exposure, but rebuilding or wiping systems too early can destroy the evidence needed for investigation.
Contain deliberately
Disable compromised accounts, isolate affected systems and block known malicious access where necessary. Record each containment action and the time it was taken so later analysis can distinguish attacker activity from response activity.
Preserve logs before they roll over
Identity, firewall, endpoint, VPN, email, cloud and application logs can have short retention periods. Export or protect relevant records early, especially where systems may overwrite older events automatically.
Identify affected data and systems
Build a working list of users, endpoints, servers, cloud services and datasets that may be involved. Separate confirmed impact from assumptions so decisions remain evidence-led.
Coordinate legal and regulatory response
Breach notification obligations depend on the data, jurisdiction and circumstances. Technical findings should support, not replace, legal and regulatory decision-making.
- Authentication and MFA logs
- Endpoint and security alerts
- Firewall, VPN and proxy logs
- Cloud audit records
- Suspicious emails or files
- A timeline of containment actions
- Re-imaging systems before relevant evidence is preserved
- Deleting alerts because they appear duplicated
- Resetting every account without recording when it happened
- Assuming encryption or malware is the only form of impact