What to Do After a Data Breach: A Small Business Timeline

After a data breach, disconnect the affected systems from the network without turning them off or wiping them, start a written log, and contact your IT provider, your cyber insurer, and an attorney the same day. Then work out what data was involved and who it belongs to. California law now gives a business 30 calendar days from discovery to notify affected residents, so the clock matters from the first hour.

This is the response guide. If nothing has happened yet, the companion post on writing an incident response plan has a template to prepare in advance. This post is general information, not legal advice.

The first hour: contain it and start a log

The FTC’s Data Breach Response: A Guide for Business puts securing your systems first. For a small office that means:

1. Take affected computers offline, but leave them on. Unplug the network cable or turn off Wi-Fi. The FTC’s wording is direct: “Don’t turn machines off until forensics arrives.” Powering down or reinstalling can erase the evidence that shows what was accessed.
2. Start a written log. Note the time, who noticed what, and every action taken. Paper is fine. This log feeds your insurance claim, any notice you send, and the review afterward.
3. Lock the accounts involved, from a clean device. Reset the password, sign the account out of all sessions, and confirm multi-factor authentication (MFA, a second sign-in step such as an app prompt) is on. In Microsoft 365 or Google Workspace, an administrator can do all three from the admin console.
4. Check for leftovers in email. Intruders often add mailbox rules that forward or hide messages. Look for forwarding rules and unfamiliar connected apps before you treat the account as clean.
5. If money moved, contact your bank’s fraud department immediately, then file a report with the FBI at ic3.gov. Our post on business email compromise covers payment fraud in more detail.
6. Tell staff what to do and what not to do. Keep working on unaffected systems, do not delete anything, and route questions to a single point of contact.

The first 24 hours: bring in the right people

• Your cyber insurer. Report the incident through the policy’s claims or breach hotline before you hire anyone. Ask whether you need to use the carrier’s approved forensic and legal firms. See how cyber insurance works for what policies typically pay for.
• An attorney. Whether you must notify anyone is a legal question, and the answer depends on exactly which data was involved. Counsel can also direct the forensic work.
• Forensic help, if the breach is serious. The FTC suggests considering independent forensic investigators to capture images of affected systems and determine the scope. For a single phished mailbox with no sensitive data, your IT provider reviewing the sign-in and audit logs may be enough.
• Law enforcement. The FTC guide advises contacting your local police department, and the FBI accepts reports from businesses of any size at ic3.gov.
• Preserve logs now. Firewall, server, email, and cloud audit logs are kept only for a limited time. Export the relevant period before it rolls off.
• Confirm your backups are intact and clean. Do not restore yet. Just verify that a copy from before the incident exists. Our business data backup guide explains what to check.

If the incident is ransomware, the containment steps are similar but recovery is different. See protecting your business from ransomware.

Days 2 to 7: find out what was accessed and close the gap

Three questions drive everything that follows: how did they get in, what did they reach, and whose information was it?

Work through the FTC’s second step, fixing vulnerabilities, based on what the investigation finds:

Likely entry point	What to check	The fix
A password entered on a fake sign-in page	Sign-in logs, mailbox rules, files opened or downloaded	Reset credentials, enforce MFA for everyone, review how to spot phishing with staff
Software that was missing updates	Which system, and which update was missing	Patch it, then set a regular patching schedule
Remote access open to the internet	Firewall rules, remote desktop exposure	Close it or put it behind secure remote access
A vendor with access to your data	What they could reach, and whether they have fixed their side	Limit their access, get written confirmation of the fix
A lost or stolen device	Whether the drive was encrypted	Remote wipe if managed, confirm encryption status in writing

The FTC also says to check whether encryption was enabled when the breach happened. That single fact can decide whether you have to notify anyone, as the next section explains.

During this week, build the list of affected people: names, the state each lives in, and which data elements were exposed for each. Notification laws follow the residence of the person, not the location of your office.

By day 30: California breach notification

California’s breach notification law is Civil Code section 1798.82. It was amended effective January 1, 2026, replacing the older “without unreasonable delay” standard with fixed deadlines.

Requirement	What the statute says
Deadline to notify residents	Within 30 calendar days of discovery or notification of the breach
Permitted delay	If a law enforcement agency determines notice would impede a criminal investigation, or as needed to determine the scope and restore system integrity
Attorney General	If more than 500 California residents are notified from a single breach, submit a sample copy of the notice electronically within 15 calendar days of notifying consumers
Format	Plain language, titled “Notice of Data Breach,” with the headings “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” and “For More Information”
Identity theft services	If you were the source of the breach and it exposed Social Security numbers or government-issued ID numbers (such as a driver’s license or passport number), offer identity theft prevention services at no cost for at least 12 months

The Attorney General’s office accepts sample notices through an online submission form.

What counts as personal information?

The law covers a person’s first name or initial and last name combined with any of the following, when either part is unencrypted: Social Security number; driver’s license, state ID, passport, or other government ID number; a financial account or card number together with any code needed to use it; medical information; health insurance information; biometric data; automated license plate reader data; or genetic data. It separately covers a username or email address combined with a password or security answer that would allow access to an online account.

Does encryption change anything?

Yes. The law applies to unencrypted personal information. Encrypted data triggers notice only if the encryption key or security credential was also acquired, or is reasonably believed to have been. A stolen laptop with full-disk encryption turned on, where the password was not taped to it, is a very different event from one without.

Other rules that may apply at the same time

If you hold	Rule	Deadline
Patient information (covered entities and business associates)	HIPAA Breach Notification Rule	Individuals within 60 calendar days of discovery. Breaches of 500 or more people also go to HHS within 60 days. Smaller breaches are reported to HHS within 60 days after the end of the calendar year.
Customer financial information (tax preparers, mortgage brokers, non-SEC investment advisers, and other firms under the FTC Safeguards Rule)	FTC Safeguards Rule	Notify the FTC as soon as possible and no later than 30 days after discovering unauthorized acquisition of unencrypted information of at least 500 consumers
Payment card data	Your processor agreement and card brand rules	Contact your payment processor or merchant bank promptly. See our PCI DSS guide.
Residents of other states	Each state’s own law	Varies. Your attorney will check each state on your list.

Medical and dental practices can find more context on our medical and dental IT page.

What should the notice say?

Beyond the required California headings, the FTC recommends telling people clearly how the breach happened, what information was taken, what you have done to fix it, and what they can do. Its guide also suggests:

• Pointing people to IdentityTheft.gov for recovery steps
• Explaining fraud alerts and credit freezes, and listing the three credit bureaus
• Considering at least a year of free credit monitoring when Social Security numbers or financial details were exposed
• Naming one contact person or page for questions, so answers stay consistent

The FTC cautions against misleading statements and against withholding details that would help people protect themselves. Send the draft through your attorney before it goes out.

After notification: recover, review, and update the plan

Restore from a backup taken before the intrusion, rebuild any machine whose integrity you cannot confirm, and watch sign-in logs closely for the following weeks. Then hold a review. CISA’s guidance is that these reviews should be blameless, focused on process rather than individuals. Record what worked, what slowed you down, and what changes. Put those changes into a written incident response plan so the next event starts with a checklist.

Common mistakes

• Wiping and reinstalling first. It removes the evidence that answers “what was accessed,” which is the question every notification decision depends on.
• Resetting the password and stopping there. Forwarding rules, connected apps, and additional admin accounts can survive a password change.
• Waiting for certainty before involving counsel. The 30 day clock in California starts at discovery, not at the end of the investigation.
• Hiring responders before checking the insurance policy. Report to the insurer first and ask which firms they approve.
• Announcing details before they are confirmed. Early numbers are often wrong. Say what you know, and say when you will update.

Common questions

How long does a business have to notify customers in California?

Thirty calendar days from the date you discover the breach or are notified of it, under Civil Code 1798.82 as amended effective January 1, 2026. A delay is allowed when a law enforcement agency determines that notice would impede a criminal investigation, or as needed to determine the scope of the breach and restore the integrity of your systems.

Does a breach have to be reported to the California Attorney General?

Only when a single breach requires you to notify more than 500 California residents. In that case you submit one sample copy of the notice, with any personally identifiable information removed, through the Attorney General’s online form within 15 calendar days of notifying the affected consumers. Smaller breaches still require notice to the residents themselves.

Is a phished email account a data breach?

It depends on what was in the mailbox and what the intruder did. If the account held messages or attachments with the data elements listed in the statute, such as Social Security numbers, medical information, or account numbers, and there is evidence of access, it may be a reportable breach. This is why preserving sign-in and audit logs matters.

Is notification required if the stolen data was encrypted?

Generally not under California law, provided the encryption key or password was not taken with it. The statute covers unencrypted personal information, and encrypted information only when the key or credential was also acquired. Other rules, such as HIPAA, have their own tests, so confirm with counsel.

Should we pay for credit monitoring for affected people?

In California it is required for at least 12 months, at no cost to the person, when your business was the source of the breach and Social Security numbers or government-issued ID numbers, such as a driver’s license number, were exposed. Outside that situation it is optional, and the FTC suggests considering it when financial information or Social Security numbers are involved.

How Coastal Growth Co. can help

During an incident we can handle the technical side: isolating systems, preserving logs, reviewing Microsoft 365 or Google Workspace sign-in activity, and closing the gap that was used, working alongside your attorney and insurer. Afterward we can help you put a written plan and the missing safeguards in place through managed IT support or a one-time project. Scope and price are agreed before paid work begins. Reach us through the contact page.