Data Incident: The First 48 Hours

Hour 0: activate, don’t improvise

The first decisions set the trajectory for everything that follows. Work the response plan you wrote in calmer times rather than inventing one under pressure. If a step below is already automated or owned by a named person, good — the checklist is a backstop, not a substitute.

• Trigger the incident-response plan. Pull up the written plan and follow it. If there isn’t one, designate a single incident lead now so decisions don’t fork across three threads.
• Stand up the core team. IT/security, legal, and a senior business owner at minimum. Add HR, communications, and the relevant business unit as scope clarifies — not before.
• Move communications off the affected systems. If email or chat may be compromised, coordinate out-of-band — phone, personal devices, a clean channel. Attackers read incident-response threads too.
• Start a contemporaneous, factual timeline. Who found what, when, and what was done. Stick to observations. Keep speculation, blame, and adjectives out of it — this log may be read by people you have not met.

Engage counsel before the investigation runs

The sequence matters. Bringing counsel in early — before the forensic work begins — is what lets the investigation be directed by counsel and gives you a basis to assert privilege over the investigative work product. Retaining forensics through counsel, rather than as an ordinary IT purchase, is a pattern many in-house teams find useful for the same reason. Privilege over an incident investigation is fact-specific and has been contested in the courts; structure for it early and confirm the current standard in your jurisdiction.

• Loop in counsel at the same time as IT. Counsel should be directing the investigation from the start, not reviewing it after the fact.
• Engage forensics through counsel where appropriate. A counsel-directed engagement, scoped to support legal advice, supports a privilege position that a routine vendor relationship does not. Coordinate this with the insurer’s panel requirements below.
• Mark privileged work as privileged — accurately. Labels don’t create privilege, but failing to segregate legal-directed analysis from routine operational reporting can forfeit it.

Contain — without destroying the evidence

This is the hardest balance in the first day. Stop the bleeding, but preserve the crime scene. The reflex to wipe and rebuild a compromised machine is the single most common way organizations destroy the record of what actually happened.

• Isolate, don’t erase. Disconnect affected systems from the network, disable compromised accounts, rotate exposed credentials. Containment and destruction are different acts.
• Image before you remediate. Forensically image affected systems before wiping, reimaging, or rebuilding. Once it’s rebuilt, the evidence of how the intruder got in is gone — and you cannot get it back.
• Preserve volatile and short-lived data first. Memory, active sessions, and logs that overwrite on a rolling window deserve priority — they vanish on their own schedule.
• Pull and preserve logs before they roll off. Firewall, VPN, authentication, endpoint, and cloud logs often retain only days or weeks. Capture them now; reconstructing the attack later depends on them.
• Suspend routine deletion across relevant systems. A litigation-hold reflex applies here: auto-purge, backup rotation, and retention timers should pause for the data and custodians in scope.

Scope methodically — before anyone asks “how bad?”

Notification obligations, regulator exposure, and contractual duties all turn on facts you do not yet have. Build the scope picture deliberately and resist the pressure to characterize it early.

1. What data was affected?

   Categories matter more than volume at this stage. Personal data, protected health information, financial account data, credentials, and trade secrets each carry different obligations.

2. Whose data, and how many individuals?

   Many breach-notification duties are counted per individual and per category. A rough, honest range beats a precise-sounding guess.

3. Which states’ residents are implicated?

   Obligations usually follow where the affected individuals reside, not where you are. One incident can pull in many state regimes at once.

4. Which regulators and contracts are in play?

   Sector rules (for example, HIPAA for protected health information) and customer-contract notice clauses add duties on top of state law — sometimes with shorter fuses.

Notify the people you’re obligated to — in the right order

• Notify the cyber insurer promptly. Carriers frequently require their own panel forensics and breach counsel, and using off-panel vendors first can jeopardize coverage. Tell them before you commit spend.
• Map the notification clocks — without overstating them. State breach-notification deadlines vary widely; HIPAA and contractual customer-notice provisions add their own; some regimes run on very short fuses. The hard clocks that actually run inside the first 48 hours are usually regulatory or contractual — most state consumer-notice deadlines run later. Identify which clocks apply to the data involved and confirm each current deadline rather than assuming a single number.
• Check contractual notice duties. Customer agreements, DPAs, and vendor contracts often require notice within a fixed window of discovery — independent of, and sometimes faster than, statute.
• Coordinate with affected vendors and processors. If the incident touches a processor, or a vendor’s compromise reached you, align on facts and on who notifies whom before anyone speaks to regulators or customers.
• Consider law-enforcement involvement. For certain intrusions and ransomware, engaging law enforcement (often the FBI or Secret Service) is worth weighing — coordinate the decision and the messaging with counsel. Treat any ransom payment as a legal decision first, not a business one: sanctions exposure and disclosure obligations can attach to the payment itself, so involve counsel before making or facilitating one.

Hold the line on communications

• Preserve everything; characterize nothing prematurely. Preservation and public statements are different obligations. Do all of the first; do almost none of the second until facts are confirmed.
• Route external statements through counsel and communications. One spokesperson, one approved set of facts. Well-meant reassurance from a help desk or a sales rep becomes a discoverable misstatement.
• Keep internal updates factual and restrained. Speculation in a chat thread reads very differently a year later as a deposition exhibit.