Data Breach Response Plan: Your First 24 Hours Checklist

Your phone buzzes. A customer says they received a strange email from your company. Then another. Then your IT lead messages: "I think we have a problem."

What you do in the next 24 hours will shape everything: how much data is lost, how long you're offline, how much it costs, and whether customers trust you afterward.

Bookmark this guide now, because you won't want to be searching for it mid-crisis.

Hour 0-1: Stop the Bleeding

Your first instinct will be panic. Your second should be containment.

• Isolate affected systems. Disconnect them from the network (unplug the cable, disable Wi-Fi).

• Don't wipe, reboot, or "clean up." This is the most common mistake. It destroys the digital evidence investigators need.

• Don't delete suspicious emails or files. Preserve everything.

• Write down what you know: who noticed, when, and what they saw.

Golden rule: Disconnect, don't destroy.

Hour 1-4: Assemble Your Team

You can't fight this alone, and you shouldn't try.

• Activate your incident response plan. No plan? Appoint one decision-maker immediately to avoid chaos.

• Call an incident response specialist. Experts can contain the attack faster and avoid costly missteps.

• Loop in legal counsel. What you say and write now may matter later.

• Use a separate communication channel. If attackers are inside your email or chat, they can read your response plan. Use phone calls or a clean, unaffected device.

Hour 4-12: Understand the Damage

Now you need answers to four questions:

1. How did they get in? (Phishing, stolen password, unpatched software?)

2. What did they access? (Customer data, financial records, employee files?)

3. Are they still inside?

4. How far did they spread?

Meanwhile, reset credentials on compromised accounts and revoke suspicious access, but only after your response team confirms the sequence. Changing passwords too early can tip off attackers or erase clues.

Hour 12-24: Notify, Communicate, Document

This is where many businesses stumble, because the legal clock is already ticking.

• Know your deadlines. Under GDPR, certain breaches must be reported within 72 hours. In India, CERT-In directions require reporting specified cyber incidents within 6 hours of noticing them, and the DPDP Act has its own breach notification duties. Rules vary by industry and region, so confirm with legal counsel.

• Prepare a clear, honest statement for customers and staff. Skip the jargon and the blame. Say what happened, what data may be affected, and what you're doing about it.

• Keep a timeline log of every action, decision, and who made it. It protects you with regulators and insurers.

• Notify your cyber insurer early. Many policies require prompt notice and may cover response costs.

5 Mistakes That Make Breaches Worse

1. Waiting to "be sure." Delay is the enemy.

2. Wiping systems and destroying evidence.

3. Going silent with customers, which erodes trust faster than the breach itself.

4. Paying a ransom without advice. Payment doesn't guarantee recovery, and it may carry legal risks.

5. Declaring victory too soon. The attacker you can't see may still be inside.

After 24 Hours: The Real Work Begins

The first day is about control. The following weeks are about recovery and resilience: restoring systems from clean backups, closing the gap that let attackers in, and testing your defenses so history doesn't repeat.

Don't Face It Alone: WhiteKnight Is Built for This Moment

Every hour counts, and guessing costs money. WhiteKnight is an incident response specialist that helps businesses:

• Contain breaches before they spread

• Investigate how attackers got in and what they took

• Recover quickly with minimal downtime

• Strengthen defenses so it doesn't happen twice
  
  Want to stay ahead of the next attack? Our guide to Cybersecurity Trends 2026: 5 Business Threats & How to Respond covers what’s coming and how to prepare.