What to Do in the First 24 Hours After a Data Breach

The first day after a suspected data breach rarely feels like a calm, orderly process. Systems may be down, employees are asking questions, and everyone wants an answer you don’t have yet. What you do in those first hours, though, shapes how much data is lost, how well you can prove what happened, and whether you meet your legal deadlines.

This guide lays out what to do after a data breach in the order it generally matters: contain, preserve evidence, assemble the right people, work out what was exposed, and start the notification clock thinking. It reflects the incident guidance on IronGate MSP’s own cybersecurity services page, which advises isolating affected systems, not deleting files, and contacting your IT provider. This is general information, not legal advice, so involve counsel early.

The First 24 Hours at a Glance

Treat the table as a map, not a stopwatch. Real incidents don’t follow a clean schedule, and some steps overlap. The order matters more than the exact timing.

Hour 0 to 1: Contain the Damage

Isolate affected systems, but don’t wipe them

Disconnect suspected devices from the network by unplugging the Ethernet cable or turning off Wi-Fi so whatever is happening can’t spread. Don’t delete files, reformat drives, or reinstall operating systems yet. Wiping a machine can destroy the evidence you need to understand how the attacker got in. If you’re unsure whether to power a device off, ask your IT provider first, because the right answer depends on the situation.

Stop further access

If you suspect a compromised account, change its password and sign it out of active sessions, using a device you trust rather than one that may be infected. Turn on multi-factor authentication where it’s missing. Coordinate this with whoever is leading the response, since resetting credentials before you understand the intrusion can sometimes make investigation harder.

Hours 1 to 4: Preserve Evidence and Assemble Your Team

Start a written timeline

Record what was noticed, by whom, and when, and keep adding to it. Save screenshots, suspicious emails, ransom notes, and alerts. This timeline becomes important later, because several notification deadlines run from when you determined, or had reason to believe, that a breach occurred.

Call the right people

Bring in the following early, rather than after you think you understand the problem:

• Your IT provider or security team, to guide containment and investigation
• Business leadership, so decisions can be made quickly
• Legal counsel, to advise on notification duties and privilege
• Your cyber insurance carrier or broker, since many policies require prompt notice and may dictate which responders you can use
• Law enforcement where appropriate, such as local police or the FBI’s Internet Crime Complaint Center

If you carry cyber insurance, review the policy before engaging outside responders; our guide to what cyber insurers require explains why carriers care about documentation and how the application ties to your claim.

Hours 4 to 12: Work Out What Was Exposed

The next question is scope. Which systems were reached? Was any personal information accessed, such as names with Social Security numbers, financial account details, or health information? Roughly how many people are affected, and where do they live? These answers decide which laws apply and what you must tell whom.

For anything beyond a simple, clearly contained incident, consider an independent digital forensics investigator. They can establish how the attacker got in, what they touched, and whether they’re still there, which is difficult to determine from the inside under pressure. Your insurer may have approved firms, which is another reason to call them early.

Hours 12 to 24: Notification, Communication, and Recovery Planning

Understand your notification clock

Notification rules vary by state and industry. In Florida, the Florida Information Protection Act (Fla. Stat. §501.171) generally requires notifying affected individuals no later than 30 days after you determine a breach occurred or have reason to believe one did. If 500 or more Floridians are affected, the Florida Department of Legal Affairs must also be notified within that window, and a short extension is possible only with a written showing of good cause. Large breaches can trigger notice to consumer reporting agencies as well. See the Florida Bar Journal overview of FIPA for background, and confirm current requirements with counsel.

Industry rules add to this. A healthcare practice, for example, also faces HIPAA breach notification rules; our article on HIPAA-compliant IT support covers the wider compliance picture.

Communicate carefully

Choose one person to speak for the business. Prepare a short internal message that tells employees what to do and what not to say, and hold off on public statements until you know what happened. Speculating early can create obligations or mistakes you’ll have to correct later.

Plan recovery before you start restoring

Don’t rush to restore from backups until you know the environment is clean, or you may reintroduce the problem. Confirm which backups are intact and untouched, then restore in a controlled order. If your systems were encrypted, our ransomware guide covers why paying should not be a first response, and Backup vs. Disaster Recovery explains what a tested recovery plan makes possible.

Mistakes That Make a Breach Worse

• Deleting files, wiping machines, or reinstalling before evidence is preserved
• Waiting to call the insurer or counsel until “we know more”
• Resetting every credential at once without a plan, which can hide how the attacker got in
• Restoring from backups before confirming the environment is clean
• Making public statements before the facts are established
• Treating the 30-day clock as the starting line rather than a hard limit

What to Set Up Before You Ever Need This

Most of the stress in a breach comes from improvising. A written incident response plan, a contact list that includes your IT provider, counsel, and insurer, tested backups, and multi-factor authentication turn an emergency into a procedure. IronGate MSP’s managed IT support and backup and disaster recovery services are built around that kind of preparation, and its cybersecurity support lists dark web monitoring, security assessments, and awareness guidance among the ways to reduce exposure before something goes wrong.

Frequently Asked Questions

What’s the difference between a security incident and a data breach?

A security incident is any event that threatens your systems or data, such as a malware infection or a suspicious login. A data breach is generally an incident in which unauthorized people actually accessed or acquired protected data, especially personal information. Many incidents never become reportable breaches, but you usually can’t know which one you have until you investigate.

Do I still have to notify people if the stolen data was encrypted?

Encryption can change the analysis, because some laws treat properly encrypted data differently. But that typically depends on the data being truly unreadable, including that the keys weren’t also exposed. Don’t assume you’re exempt; have counsel review the facts before deciding.

Do we need to hire a forensic investigator?

Not for every incident, but for anything involving personal data, unclear scope, or possible ongoing access, an independent investigator is usually worth considering. Their findings help determine who must be notified and can support insurance and legal positions. Check your policy first, since insurers often have preferred providers.

What should we tell employees right away?

Tell them there is an issue being investigated, what to do and avoid (for example, not powering off devices on their own or discussing it publicly), and who to contact with questions. Keep it factual and short, and update it as you learn more. Clear instructions reduce rumors and accidental evidence loss.

Conclusion

The first 24 hours after a data breach come down to a handful of priorities: contain without destroying evidence, assemble IT, legal, and insurance help quickly, work out what was exposed, and keep track of your notification deadlines. You won’t have every answer on the first day, but acting in the right order keeps options open.

If you want a plan in place before an incident, IronGate MSP offers a no-obligation consultation to review your current security and recovery setup. If you already work with an IT provider and think you’re in the middle of an incident, call them first. Schedule a consultation.