Step 1: Don't Panic-Delete Everything

Your first instinct will be to shut everything down, wipe affected machines, and start over. Resist this. Wiping systems destroys forensic evidence that you'll need for the investigation, for your insurance claim, and potentially for law enforcement. The FTC specifically advises against destroying evidence during a breach investigation.

Step 2: Assemble Your Response Team

You need three roles filled immediately, even if one person wears multiple hats:

• 1

  Technical lead: your IT person, MSP, or the first competent technical person you can reach. They're going to assess scope and contain the damage.

• 2

  Legal counsel: ideally someone with data breach experience. If you don't have one, your insurance carrier will assign one. If you don't have insurance, the Pennsylvania Bar Association's Lawyer Referral Service can help: (800) 692-7375.

• 3

  Decision maker: someone with authority to approve expenses, shut down systems, and communicate with customers. In a small business, this is probably you.

Step 3: Assess What Happened

Before you can respond effectively, you need to understand the basics. Your technical lead should try to answer these questions:

You won't have complete answers to all of these in the first 24 hours. That's fine. Document what you know and what you don't know. "We think they got in through a phishing email but we're not sure what data they accessed" is a perfectly valid initial assessment.

Step 4: Contain the Breach

Containment means stopping the bleeding without destroying evidence. Depending on the attack type:

• • Ransomware: Isolate affected machines. Check if backups are intact and unencrypted. Do NOT pay the ransom yet. Talk to your carrier and law enforcement first.
• • Compromised email: Force password resets on all affected accounts. Revoke active sessions. Check for forwarding rules the attacker may have set up (this is commonly missed).
• • Unauthorized access: Disable the compromised credentials. Review access logs for lateral movement. Change admin passwords on critical systems.
• • Data exfiltration: Block the IP addresses involved (if identified). Preserve firewall and server logs. Begin cataloging what data was stored on affected systems.

Step 5: Document Everything

Start a breach log. A shared document or even a legal pad where you write down every action taken, when it was taken, and by whom. This documentation will be critical for:

• • Your insurance claim (carriers will ask for a detailed timeline)
• • Regulatory compliance (proving you responded promptly and appropriately)
• • Law enforcement investigation
• • Legal defense if customers or partners sue

Include timestamps, screenshots where possible, and the reasoning behind decisions. "We decided not to shut down the payment server because it would affect 200 active transactions" is useful context six months later when a regulator asks why.

Step 6: Report to Law Enforcement

File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. If the attack involves ransomware, also contact your local FBI field office. Pittsburgh's is at (412) 432-4000. For significant breaches, they may be able to provide threat intelligence that helps your forensic investigation.

Law enforcement won't fix your breach, but the report creates an official record, may help identify the attackers, and some insurance policies require it.

Bring In a Forensics Team

Unless the breach was trivially small (a single phishing email with no data exposure), you need a professional forensic investigation. This isn't your IT guy running antivirus. It's a certified digital forensics firm that will image affected systems, analyze attack vectors, determine the full scope of the breach, and produce a report.

Forensic investigations typically cost $10,000–$75,000 depending on the size of your environment and complexity of the attack. That's one of the big-ticket items cyber insurance covers. According to IBM's 2024 report, detection and escalation costs (which includes forensics) averaged $1.63 million across all breaches studied.

If you have cyber insurance, your carrier will assign a forensic firm from their approved panel. Using an unapproved firm can mean paying out of pocket even if you have coverage.

Understand Your Legal Notification Obligations

Every U.S. state has a data breach notification law, and they're all slightly different. Here's what matters if you're a Pennsylvania business:

If you have customers in other states, their notification laws apply too. Some are stricter:

If you handle health information, HIPAA requires notification within 60 days. If more than 500 people are affected, you must also notify HHS and "prominent media outlets" serving the affected area. PCI-DSS has its own notification requirements for payment card data.

Draft Your Communications

You'll need to notify affected customers, and how you do it matters as much as the notification itself. The two biggest mistakes we see:

Have your legal counsel review all communications before they go out. If your cyber policy includes crisis communications coverage, use it. Professional PR guidance during a breach is genuinely valuable.

When Cyber Insurance Kicks In

If you have cyber insurance, here's what a typical claims process looks like during the first week:

The IBM 2024 report found that organizations with cyber insurance paid an average of $5.17 million per breach versus $5.45 million for those without. The savings aren't just in direct payments. Insured organizations tend to respond faster because they have immediate access to experienced breach response teams.

Execute Notifications

By now, you should have a clear picture of what data was compromised and who was affected. It's time to send notifications. For a typical breach involving customer PII, your notification package should include:

• • A clear description of what happened and when
• • Specifically what data was involved
• • What you've done to address the breach
• • What the affected person should do (monitor accounts, change passwords)
• • Contact information for questions
• • Information about credit monitoring or identity theft protection you're offering

Credit monitoring services for breach victims typically cost $2–$5 per person per month for 12–24 months. For 1,000 affected individuals, that's $24,000–$120,000 . Another cost that cyber insurance absorbs.

Remediate and Rebuild

Once the forensic investigation identifies how the attackers got in and what they did, you need to close the holes and rebuild affected systems:

• • Patch the entry point: whether it was a vulnerable VPN, an unpatched server, or a phishing-susceptible email system
• • Reset all credentials: not just the compromised ones. Attackers often create backdoor accounts
• • Rebuild affected systems from known-good backups or fresh installs
• • Implement MFA if you haven't already (most carriers will require this for renewal after a claim)
• • Review access controls: does everyone really need admin access? The answer is almost always no

Note: remediation and security improvement costs are generally NOT covered by cyber insurance. Your policy pays for the breach response, but upgrading your security afterward is on you. Think of it like car insurance: they'll fix the damage from the accident, but they won't buy you new tires.

Conduct a Post-Incident Review

Once the immediate crisis is handled, sit down with everyone involved and honestly assess what happened: