Your Data Breach Playbook: What to Do in the First 72 Hours

What's Happening Right Now

Data breaches are no longer a question of "if" but "when." According to IBM's Cost of a Data Breach Report 2025, the global average cost of a breach reached $4.88 million — a figure that has climbed steadily for three consecutive years. For small and mid-sized businesses (10–500 employees), the median cost sits closer to $2.4 million, which is often enough to shutter a company within six months of the incident.

The threat landscape in 2025–2026 is defined by two trends that directly affect SMEs. First, ransomware-as-a-service (RaaS) operations like LockBit successors, BlackSuit, and Cl0p have industrialized attacks, meaning criminal groups now target businesses with as few as 20 employees. Second, supply chain compromises — where attackers breach a software vendor and infect every downstream customer — have become the primary vector for large-scale data theft. The 2023 MOVEit breach alone compromised data belonging to over 2,700 organizations and 90 million individuals.

If you have customer data, employee records, or payment information sitting on your systems, you are a target. The question is whether you have a plan for when it happens.

How This Attack Works

A data breach rarely begins with a dramatic hack. It usually follows a predictable sequence that security researchers map using the MITRE ATT&CK framework:

Step 1: Initial Access. An employee clicks a phishing link, or an attacker exploits an unpatched vulnerability in a public-facing application. In roughly 34% of breaches, stolen credentials obtained through phishing are the entry point.

Step 2: Persistence and Privilege Escalation. The attacker establishes a foothold — often by creating a hidden account or installing a remote access tool like AnyDesk or a Cobalt Strike beacon — then escalates privileges to reach sensitive data stores.

Step 3: Lateral Movement. Within hours or days, the attacker moves through your network, hopping from one system to another until they locate databases, file shares, or cloud storage containing customer records.

Step 4: Exfiltration. Data is compressed, encrypted, and sent to external servers. This is the actual "breach." In ransomware cases, exfiltration is followed by encryption of your systems, combining data theft with operational paralysis.

The critical detail: the average time to identify a breach in 2025 is 204 days. Attackers are inside your environment for roughly seven months before detection. Your response window is not the day the breach happens — it's the day you discover it.

Real-World Examples

MGM Resorts International (September 2023): Attackers used social engineering against the IT help desk to gain access, then deployed ransomware. The breach exposed personal data of approximately 10.6 million guests. MGM reported $100 million in lost revenue in a single quarter and faced multiple class-action lawsuits.

23andMe (October 2023): A credential-stuffing attack combined with a scraping tool exposed genetic data of 6.9 million users. The company faced a $300 million class-action lawsuit. The attack succeeded because users had not enabled multi-factor authentication.

A mid-market accounting firm (anonymized, 2024): A 45-person firm in Texas received a single phishing email on a Friday afternoon. An employee entered their Microsoft 365 password on a cloned login page. The attacker accessed email, client tax records, and payroll data over the weekend. By Monday, the firm had 14 days of downtime, 800 clients requiring notification under state law, and $190,000 in direct remediation costs — excluding legal fees and lost contracts.

Who Is Most at Risk

Businesses with 10–500 employees face the highest relative risk because they combine valuable data with limited defensive resources. Specific high-risk profiles include:

• Professional services firms (accounting, legal, consulting) holding client financial and personal data
• Healthcare providers and clinics subject to HIPAA, holding sensitive medical records
• E-commerce and SaaS companies processing payment card data under PCI DSS
• Manufacturers and logistics companies targeted for operational disruption via ransomware
• Any business using cloud services (Microsoft 365, Google Workspace, AWS) without properly configured security controls

If your organization stores Social Security numbers, health records, payment data, or government-issued IDs, you are legally obligated to respond to a breach under specific notification laws.

Warning Signs to Watch For

Your employees and IT staff should report these immediately:

• Unexpected password reset emails or MFA prompts for accounts they did not access
• Unfamiliar devices or locations appearing in cloud service login history
• Sudden spikes in outbound network traffic or unusual data transfers to external cloud storage services (Dropbox, WeTransfer, Google Drive links from internal accounts)
• Ransomware notes (text files with .txt or .html extensions appearing across file shares)
• Employees reporting slow systems, files renamed with strange extensions, or inability to access databases
• Unusual administrative activity in Microsoft 365 or AWS CloudTrail logs

Establish a clear reporting channel — a dedicated email, a phone number, or a Slack channel — so employees can escalate without fear of blame.

How to Protect Your Business

Follow the NIST SP 800-61 Incident Response framework as your backbone. Here is a prioritized defense structure using the CIS Critical Security Controls:

• Enable phishing-resistant MFA (passkeys, FIDO2 hardware keys, or Microsoft Authenticator with number matching) on all email and admin accounts. SMS-based codes are vulnerable to SIM-swapping.
• Audit your Microsoft 365 or Google Workspace admin logs for suspicious sign-ins from the past 90 days.
• Confirm you have offline, encrypted backups that cannot be reached from the production network.

• Retain a breach response firm or at minimum, have the contact information for incident response providers (Mandiant, CrowdStrike, or regional firms) and breach counsel ready before an incident occurs.
• Document your data flows: what customer data you collect, where it is stored, and how long you retain it. This is required for GDPR Article 30 and is essential for scoping a breach.
• Subscribe to CISA's free alerts and the FBI's IC3 reporting portal so you receive threat intelligence relevant to your industry.

Ongoing:

• Conduct tabletop exercises twice per year simulating ransomware and data exfiltration scenarios with your leadership team.
• Review your cyber insurance policy: confirm it covers notification costs, credit monitoring, legal defense, and business interruption. Many SME policies do not.
• Implement data minimization — delete customer records you no longer need. You cannot breach data you do not store.

Quick Action Checklist

If you discover a breach today, prioritize in this order:

• Isolate affected systems immediately — disconnect from network, do not shut down (preserves memory evidence for forensics)
• Activate your response plan — call incident response, notify leadership, engage breach counsel
• Preserve evidence — do not delete logs, do not reinstall systems until forensics team confirms collection is complete
• Determine scope — what data, how many records, which individuals
• Assess legal obligations within 72 hours — GDPR requires notification to your supervisory authority within 72 hours of awareness. Singapore's PDPA requires notification to the PDPC within 3 calendar days if the breach is likely to cause significant harm. US state laws (California, New York, Texas, and 47 others) require notification "as soon as practicable" — often within 30 days
• Notify affected individuals using clear, plain-language communication (see templates from CISA's Breach Response Guide)
• Offer credit monitoring for at least 12 months to individuals whose Social Security or financial data was exposed
• File a report with the FBI's IC3 and your national CERT
• Conduct a post-incident review within 30 days — document root cause, response gaps, and remediation commitments with deadlines

Start Here This Week

Open your Microsoft 365 admin portal or Google Workspace console right now. Navigate to Security → Sign-in logs. Filter for the last 30 days and look for sign-ins from unfamiliar countries, impossible travel, or legacy authentication protocols. If you find anything suspicious, treat it as an incident. Then, take 15 minutes to write down the three phone numbers you would call if you confirmed a breach: your IT provider, your insurance broker, and a local breach attorney. Tape that list to your monitor. When the moment comes — and it may come sooner than you expect — you will not have time to think. You will need to act.