A data breach rarely arrives with a warning. One morning a file server is encrypted, a customer emails about a fraudulent charge, or an alert fires at 2 a.m. What your small business does in the next hour often matters more than anything else that follows. This guide walks you through a practical, step-by-step data breach response plan built for SMB owners and IT staff who do not have a full-time security team, with an emphasis on the mistake that quietly ruins most investigations: destroying the forensic evidence you will later need.

This article is general information, not legal advice. Data breach notification duties vary by state and by industry, and the deadlines are strict. Confirm your specific obligations with qualified counsel.

The First Hour: Contain, Don’t Destroy

The instinct to “clean up” is the most expensive reflex in incident response. Wiping a machine, reimaging a server, or deleting suspicious files erases the exact artifacts an investigator uses to determine how the attacker got in, what they touched, and whether regulated data left your network. Slow down and protect the scene first.

Isolate, do not power off. Disconnect affected systems from the network (unplug the cable, disable Wi-Fi, or isolate the VLAN) to stop the spread. Avoid shutting a machine down when you can help it, because memory contents and live artifacts are lost on power-off.
Do not wipe or reimage anything. Preserve the systems exactly as found. No “quick reinstalls,” no deleting files, no running clean-up tools.
Preserve logs immediately. Firewall, VPN, endpoint, email, and cloud logs often roll over or expire. Extend retention and export copies now.
Change credentials from a clean device. Reset passwords and revoke sessions and API keys, but do it from a device you trust is not compromised.
Write everything down. Start a timeline: who found what, when, and what actions you took. This record becomes part of your evidence.

The U.S. Federal Trade Commission’s Data Breach Response: A Guide for Business reinforces the same priority order: move quickly to secure operations and fix vulnerabilities, but preserve evidence and bring in forensic experts before you remediate.

Assemble Your Response Team

Even a small company needs defined roles during a breach. Identify, in advance if possible, an incident lead (usually the owner or IT manager), someone to handle communications, and a point of contact for outside partners. Just as important is knowing who to call from outside the building:

Digital forensics and incident response (DFIR) specialists to image systems, analyze the intrusion, and determine scope.
Legal counsel experienced in privacy and breach notification. Engaging counsel early can also help structure the investigation appropriately.
Your cyber insurance carrier, if you have a policy. Many require you to use approved vendors and to notify them promptly, or coverage can be reduced.

Contain vs. Eradicate

These are two different phases, and rushing the second undermines the first. Containment stops the bleeding: isolate affected hosts, block malicious IPs and domains, disable compromised accounts, and cut off the attacker’s access. Eradication comes later, only after forensics has established how the attacker entered and how far they moved. If you eradicate before you understand the intrusion, you risk leaving a backdoor in place and reinfecting yourself the moment you restore. As the FTC puts it, the only thing worse than a data breach is a second one.

Forensic Imaging and Chain of Custody

Before affected systems are analyzed or rebuilt, a forensic examiner captures a bit-for-bit forensic image of the drives and, where possible, volatile memory. Working from an image, rather than the live system, means the analysis does not alter the original evidence. This matters if the breach leads to litigation, an insurance dispute, or a regulator’s questions.

Equally important is chain of custody: a documented record of who handled each piece of evidence, when, and how it was stored. Unbroken custody is what makes findings defensible. Handled informally, evidence can be challenged or thrown out. This is a core reason to bring in trained examiners rather than improvising internally. Our digital forensics team handles imaging and custody so your evidence holds up.

Determine the Scope: What Data, Whose Data

Notification obligations hinge on facts, not fear. The investigation should answer: which systems were accessed, what data was exposed or exfiltrated, and how many individuals are affected. Pay special attention to regulated categories such as names paired with Social Security numbers, driver’s license numbers, financial account details, health information, or login credentials. The specific data elements involved often decide whether, when, and how you must notify. Guessing high or low both create problems, which is why the forensic scope determination should drive your legal analysis.

Notification Obligations

In the United States, breach notification is governed by a patchwork of laws. All 50 states have breach notification statutes, and depending on your business you may also face federal or sector rules (for example, healthcare or financial-services requirements) and, if you serve customers abroad, foreign regimes. Deadlines, thresholds, and required content differ by jurisdiction. Reporting a cyber incident to the government is also part of many response plans; CISA accepts reports and provides guidance at its official reporting page. Because the rules vary so much, coordinate notifications with counsel rather than sending anything on your own timetable. Again: this is general information, not legal advice, and notification duties vary by state.

Recovery and Hardening

Once forensics has mapped the intrusion, you can rebuild with confidence. Restore from known-clean backups, rotate all credentials and keys, patch the vulnerabilities that were exploited, and validate that the attacker’s access is gone before reconnecting systems. Use the incident as the blueprint for hardening: enforce multi-factor authentication everywhere, tighten network segmentation, improve logging and monitoring, and review vendor and remote-access pathways, which are common entry points.

Prevention: Tabletop Before the Real Thing

The businesses that recover fastest are the ones that practiced. Build a written incident response plan, keep an offline contact sheet (DFIR, counsel, insurer), and run a tabletop exercise, a walk-through of a realistic scenario, at least annually. A tabletop surfaces the gaps, an unclear decision-maker, missing logs, backups that were never tested, while the stakes are still hypothetical.

Frequently Asked Questions

Should I turn off the hacked computer?

Generally no. Disconnect it from the network to stop the spread, but avoid powering it off, since shutting down can destroy valuable memory-based evidence. Let a forensic examiner decide how to preserve the system.

Can’t my IT person just clean it up and move on?

Cleaning up before evidence is preserved can erase how the attacker got in, leave a backdoor behind, and undermine any later investigation, insurance claim, or legal position. Contain first, preserve evidence, then remediate with professional support.

Do I have to notify customers after a breach?

Often yes, but it depends on what data was involved and the laws of the affected individuals’ states. Requirements and deadlines vary widely, so determine the scope forensically and confirm your specific obligations with legal counsel before notifying.

How fast do I need to act?

Immediately for containment and evidence preservation, within the first hour if you can. Notification timelines are separate and are set by law, sometimes measured in days, which is another reason to engage counsel early.

Get Expert Help Fast

Honeybadger Solutions is a veteran-owned (SDVOSB), licensed investigations, security, digital-forensics, and cyber firm serving clients nationwide from our Casa Grande, Arizona headquarters. If you are in a breach now, or want a plan before you ever need one, our team can help you contain the incident, preserve evidence properly, and move toward recovery. Call 602-725-2818 or book a consultation.

Related: Cyber Services · Digital Forensics · Investigations