You suspect that your business experienced a data breach. Maybe an employee lost a laptop, or a hacker got into your customer database, or information was inadvertently posted on your website. Whatever happened, you’re probably wondering what to do next.
The FTC’s new Data Breach Response: A Guide for Business outlines the steps to take and whom to contact. Here’s a glimpse of what’s inside.
You’ll need to move quickly to secure your systems. Some immediate steps include:
- Secure physical areas potentially related to the breach. Lock them and change codes, if needed.
- Stop additional data loss. Take all affected equipment offline right away, but be careful not to destroy evidence. Monitor all access points to your system. If a hacker stole credentials, you’ll need to change those credentials too, even if you’ve removed the hacker’s tools.
- Remove improperly posted information from the web. After you clean up your site, conduct a search to make sure other sites haven’t posted the information. If they have, ask them to remove it.
Think about your service providers. If they were involved, make sure they’ve remedied all vulnerabilities and consider whether you need to change their access privileges. Also, check your network segmentation so a breach at one server or site doesn’t lead to a breach at another.
What about breach notification? That’s where many companies have questions. First, take a look at your state’s data breach notification law. If it’s a breach involving health information, also look at the HIPAA Breach Notification Rule and the FTC’s Health Breach Notification Rule. Notify law enforcement, affected businesses and individuals.
- Law enforcement – Call your local police, the FBI or the U.S. Secret Service. The sooner they learn about the breach, the more effective they can be.
- Businesses – If account information (like credit card numbers) was stolen and you don’t maintain the accounts, notify the institution that does so they can keep an eye out for suspicious activity.
- Individuals – The faster you notify people, the faster they can take steps to protect their information. In deciding who to notify and how, consider state laws, the nature of the breach, the type of information taken, the likelihood of misuse and the potential damage if the information is misused. When notifying people, consult with law enforcement and, depending on the type of information breached, consider offering at least a year of free credit monitoring.
The Data Breach Response guide includes a model data breach notification letter. Like the model letter, your letter should clearly describe: how the breach happened, what information was taken, what actions you’ve taken, and what steps individuals can take. We recommend including the relevant portions of IdentityTheft.gov/databreach based on the type of information exposed. Also, encourage people who discover their information was misused to file a complaint with the FTC, using IdentityTheft.gov.
Used with permission from FTC Business Center Blog