Suspected Data Breach: the First 24 Hours for Small Teams

A breach response has two clocks: the technical one (hours) and the legal one (days, and it starts whether or not you feel ready). The first 24 hours decide both. The checklist: confirm scope before you announce, contain without destroying evidence, preserve first, notify per your actual obligations — and write everything down with timestamps.

1. Confirm before you announce (hours 0–2)

"We think we were breached" and "we were breached" are different statements, and each one triggers different duties:

Scope before announcements: what data (rows and fields), when (first/last access), and how many people. You will need all three for every notification you send.

2. Contain — without destroying evidence (hours 0–4)

• Rotate every credential in the blast radius (see the secrets rotation checklist) — but export and preserve logs first: auth logs, access logs, and the affected service's audit trail. Rotation without preservation deletes your own alibi.
• Isolate the affected system rather than wiping it. A rebuild destroys forensics; an isolation (firewall off-box, revoke tokens) stops the bleeding and keeps the trail.
• Snapshot before you fix. Disk images and log exports to somewhere the attacker can't reach.

3. The notification clocks (hours 2–24)

Notification duties vary by jurisdiction and industry — the small-team reality is that most breaches fall under at least one of these:

• GDPR-style rules: report to the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to risk rights; notify individuals if the risk is high.
• US state laws: most trigger "without unreasonable delay," some with specific deadlines; check the states your customers live in, not just your HQ.
• Contract clocks: enterprise customers' DPAs often require notification in 24–72h regardless of materiality thresholds. Read the contract now, not later.

When in doubt, get counsel involved early — the cost of an hour of advice is trivial next to a mis-filed notification. This checklist is operational, not legal advice.

4. Tell customers the true shape, not the comfortable shape

• What happened, what data, what you did, what they should do. Four sections, plain language, no adjectives.
• Specific beats reassuring: "email addresses and hashed passwords, not payment data" is worth more than "sophisticated attack." If hash types matter to their risk, say so.
• Individual notifications for personal-data exposure — even where the law wouldn't force it, churn and trust math usually favor the honest note.
• One channel of truth: a status-page post plus direct emails; keep every version timestamped (see the communication templates).

5. The mistakes that turn a breach into a crisis

• Announcing scope you haven't confirmed. Walking back an over-broad statement is worse than a slower, accurate one.
• Rotating logs off the compromised system before exporting them. The logs are your scope evidence.
• Waiting for certainty on the notification clock. "Becoming aware" starts timers; legal advice on day 3 is cheaper than an unexcused late notice.
• No written timeline. Regulators, insurers, and customers all eventually ask the same question: when did you know what? Timestamps are the answer.

Takeaways

• Scope before you speak; confirm before you announce.
• Preserve logs, isolate instead of wipe, and put counsel on the notification clocks early.
• Tell customers the true shape — data categories, risk, and the exact steps they should take.

---

The Ops Starter Kit ($14) includes the incident templates and evidence-log structure that make a breach response survivable, and Vol. 2 ($27) adds the full DR plan and evidence log. Launch week: 30% off any paid kit with code HIVE-LAUNCH30 at checkout.