Your Company Got Breached: the Hour-by-Hour Plan for the First 72 Hours

Key Takeaway

• ⏱️ The clocks run on discovery: the EU notification clock starts the hour you become aware of a breach, so a data breach response plan decided today is the only version that survives contact with a real incident.
• 🗒️ The first four hours: contain the system, revoke tokens and credentials, and preserve the logs; deleting evidence during cleanup is the mistake that turns a manageable incident into a legal one.
• 📋 Who gets told, and when: one breach can trigger four parallel notifications, EU supervisory authority within 72 hours, affected individuals without undue delay, plus NIS2-style incident clocks and contractual notices to every partner.
• 📨 File with what you know: the EU framework accepts phased notification, so waiting for the perfect damage report costs you the deadline; the first filing is due on time, not complete.
• 🧾 The one-month close: the final report, the root-cause fix and the board briefing convert the incident into evidence that your program works.

A data breach response plan written the week of an incident is worth almost nothing, and the notification clocks the law attaches to a breach start on the hour your company becomes aware. A structured data breach response follows a clock, not a mood. European rules require a supervisory notification within 72 hours where feasible and an early warning within 24 hours under incident-reporting regimes for critical services, while United States requirements spread across dozens of state statutes with deadlines measured in days. The sequence below is the hour-by-hour plan for the first 72 hours, built so a small team can execute it without a crisis consultant on the payroll.

Data Breach Response Starts Before the Breach

Every hour in this plan assumes somebody already answers five questions without opening a database. Who is on the data breach response team? Who owns the decision to notify? Which counsel, insurer and forensics firms have been briefed? Where is the evidence-preservation procedure? Who speaks publicly? Write the answers down, versioned and dated, and your incident hour zero begins with execution instead of an emergency meeting.

Two contract clauses decide whether your clocks are even reachable. Processors must notify their controllers without undue delay after becoming aware of a breach, and the EU framework notes that processors typically owe that notice within roughly 24 to 48 hours where the contract specifies it. If your supplier agreements still say a vendor is “committed to best-efforts security,” your 72-hour clock started on someone else’s kindness. Fix the language now, and record a data breach response register entry for every incident from day one, documented so a regulator can verify how you reached judgment.

Hour 0 to 4: Contain, Preserve, Triage

The first block of any data breach response is containment, and it has three phases. Contain. Disconnect the affected systems from the network; do not power off machines that hold volatile memory, because memory contents and logs are the evidence that answers what happened. Revoke exposed credentials and active sessions in bulk: forced password resets, session invalidation, key rotation. If the entry point involved stolen credentials, run your compromised-account sweep immediately rather than waiting for forensics to finish.

Preserve. Preserve logs, images, traffic captures and ticket histories under a simple legal hold, and tell the team in writing that nothing gets wiped during cleanup. Remediation that destroys evidence is how companies lose the ability to prove the scope they later claim.

Triage. Answer the three classification questions in writing: what data categories are involved, how many people are potentially affected, and was data exfiltrated or only reachable. Access alone with strong encryption may avoid a duty to notify individuals; exfiltrated credentials from a customer database changes everyone’s weekend. This triage memo becomes the backbone of your first authority filing hours later, and the backbone of any data breach response your auditors later review.

Run the plan before you need it, once a quarter. A two-hour tabletop where the team walks the first four hours against a fictional supplier breach catches the gaps no document shows: the manager who did not know he was the notifier, the laptop that cannot reach the backup console at midnight, the call tree that lists a colleague who left in March. The exercise should end with a written list of fixes and a date to re-test, because an untested plan is a document, not a capability.

Out-of-band communications deserve their own line item. Assume corporate email is compromised the moment the incident is, and pre-arrange a fallback channel for the response team: a separate messaging group on personal devices, an alternate domain or a phone conference bridge. The attackers who hold your inbox read your response mail as fast as your executives do, and several 2026 incidents got worse because the response team coordinated on the compromised system itself.

The First Full Day: Scope, Classify, Decide Who Must Know

The middle of the first day is scoping work, and the decision table it produces decides the rest of the plan. For European operations, awareness triggers the EU supervisory notification analysis, and high-risk incidents also trigger direct communication to affected individuals without undue delay. If your organization is an essential or important entity under the EU’s critical-services law, the separate incident clocks already described in this piece run in parallel: early warning within 24 hours, formal notification within 72, final report within one month. Financial firms in the EU carry even tighter operational-resilience timelines, with initial major-incident notices measured in hours rather than days.

United States obligations are jurisdictional rather than directive-based, and the practical reading is the one that matters on day one: each state statute defines its own triggers, and third-party data holders pass information to their clients quickly. Some health-sector and financial-sector rules run their own clocks, measured in days. The safe operating rule for a company with exposure in multiple states is to prepare the master fact sheet once and notify against each statute from the same verified facts, using a consolidated GDPR and US notification checklist rather than memory.

Contractual notification comes next, because partners are waiting for it. Customers, merchants, procurement teams and every processor in your chain should receive the facts they are contractually owed inside their windows. A supplier incident notice with “we are investigating” is acceptable; silence is how vendors get terminated.

The Jurisdiction Map: Build It Before You Need It

The single most useful pre-breach document is a page-long jurisdiction map. It lists everywhere your data lives and is served: EU member states with their supervisory authorities, every US state where you hold resident records with its statute and deadline, the sector rules that apply to you, and the contractual windows your customer agreements impose. Against each entry it names who files, from which template, with what registration number. Rebuild it quarterly, because state legislatures amend their statutes every session and your data footprint moves quietly as you add customers.

The map pays for itself on breach day in a second way. When the first filing must leave within a deadline measured in hours, nobody is researching whether a particular statute covers records you merely “processed” two years ago. The map answers scope questions in minutes, and it converts the notification decision from legal research into execution, which is exactly what a deadline measured in hours requires.

Before the 72-Hour Mark: The Formal Notifications

By the second day of data breach response, the filing becomes the main work. For the EU analysis, the controlling text is Article 33, and the rule to internalize is that notification is due without undue delay and where feasible within 72 hours of awareness, and where the picture is incomplete, the first filing goes in anyway, in phases. Waiting for the perfect damage assessment is the classic failure; the framework explicitly permits phased notification under Article 33(4), so the on-time partial filing is the compliant move, followed by updates as facts harden.

A first filing contains the facts you can certify: nature of the incident, categories and approximate numbers of data subjects and records, likely consequences, the containment already taken, and the contact point for follow-up. Keep the register entry aligned with the filing. Individual notices, where required, state what happened, what data is involved, what you have done, and what the person should actually do, in plain language, because the version of this letter your customers retell matters more than the version regulators file.

Day two also fixes the story internally. Data breach response also fixes the story internally: sales, support and the front desk get one approved script. The press gets one named spokesperson. Executives repeat facts, not hypotheses, and hypotheses stay off the record, because every optimistic guess that leaks becomes the story you defend later.

Day 3 to 30: Remediate, Report, Review

The insurer relationship runs on its own deadlines and deserves respect. Most policies require prompt notice and impose consent rights over forensics vendors, PR spend and even settlement communications. Companies that notify late, or that hire breach counsel outside the panel, can find parts of the claim disputed. Make the insurer call, with the policy number and the incident summary, inside the first day, and route every engagement letter through the coverage team before signature.

After the filings, data breach response becomes deliberately unglamorous. Notify every statutory clock’s second wave: the incident-notification updates under critical-services rules, the interim operational-resilience update where one is owed, the state-law refreshes as headcounts firm up. Complete the final report within the month where the regime requires it. For the EU critical-services framework, the final report is a statutory obligation, not an optional courtesy, and its contents overlap the EU analysis of Article 33 closely.

In data breach response terms, root-cause work lands here, and the reading order matters: fix the exploited path, then the audit trail, then the architecture that made the path profitable. Where credentials drove the entry, the small-business checklist’s floor, multi-factor everywhere, tested backups, patch discipline and a written inventory, is the cheapest remediation package. If stolen sessions started it, session hijacking controls belong in the fix, because a password reset alone does not touch a live cookie.

Close the loop with a board briefing and a plan revision date. Regulators increasingly ask what the organization learned and changed, and the one honest artifact is your revised incident register plus an updated call tree. The credential-theft economy behind many 2026 breaches does not pause for your remediation, so the re-test cadence you set now determines whether next year reads like this year.

The Ten Mistakes That Turn a Breach Into a Crisis

1. Waiting for the full story before the first filing. Phased notification exists; use it on the clock you have.
2. Cleaning so aggressively that evidence disappears. Preserve first, remediate deliberately, log every wipe.
3. Notifying regulators and not partners. Contractual windows keep businesses; statutory windows keep regulators. Both matter commercially.
4. Reinforcing from the wrong device. Run resets, revocations and mailouts from known-clean hardware, on verified networks, from accounts you hold out-of-band.
5. Letting a dozen executives answer customers. One spokesperson, one script, one fact sheet.
6. Guessing scope out loud. Numbers firm up daily; the master fact sheet versioning handles it.
7. Treating individuals like a compliance chore. Plain and useful beats legal and vague; the customers who get real guidance become the calmest ones.
8. Silence toward the supplier that caused it. Written vendor notice starts their liability clock and preserves your contracts.
9. Skipping the insurance call. Insurers impose their own forensics and consent steps; the policy may void if notification runs out of order.
10. Archiving nothing. The register, the filings, the evidence trail and the final report form the record that protects next year’s team.

Frequently Asked Questions

What is the first step in data breach response?

Containment and evidence preservation, in that order, from a documented plan: isolate affected systems while keeping machines running for memory and logs, revoke exposed credentials and sessions, and open a written register entry that timestamps your awareness.

How fast must a data breach be reported in the EU?

Supervisory authority notification is due without undue delay and where feasible within 72 hours of awareness, with phased filings accepted when facts are incomplete; individuals at high risk are told without undue delay. Critical-services regimes add a 24-hour early-warning duty alongside.

Who must you notify in a data breach in the United States?

That depends on each affected state’s statute, since triggers and deadlines vary, and on sector rules for health and financial data. Third-party holders generally owe fast notice to their clients, who then notify individuals. Prepare one verified fact sheet and notify per statute from it.

Do customers have to be told about a data breach?

In the EU, when the breach poses a high risk to their rights and freedoms, yes, directly and without undue delay. In the United States, state statutes define the thresholds, commonly identity-theft-capable data; encryption and mitigation can change the answer. Your jurisdiction map decides.

Can I notify partially and update later?

For EU filings, yes: the framework explicitly accepts phased notification when information is unavailable at first filing. File what you can certify on time, then update as evidence consolidates. The deadline is the hard part; completeness improves with each update.

What should be in a data breach response plan before anything happens?

The call tree with named owners on every role, the preservation procedure, pre-briefed counsel, forensics and insurer contacts, the register template, the jurisdiction map, supplier clauses with hard notification windows, and an approved holding statement. The plan is the response; everything on breach day is execution.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google — free, one click, and it helps other Filipinos find the answers faster.

Financial Disclaimer

This article is published for general informational and educational purposes and does not constitute legal, security-consulting or professional advice. Notification deadlines and thresholds vary by regime and change over time; verify each requirement against your own jurisdictions, contracts and counsel before acting. WorldNgayon and its author accept no liability for losses arising from the use or misuse of this information. No compensation was received for this article unless explicitly disclosed.

@online{agron2026databreach,
  author       = {Agron, Edmon},
  title        = {{Your Company Got Breached: the Hour-by-Hour Plan for the First 72 Hours}},
  year         = {2026},
  date         = {2026-11-11},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/data-breach-response-plan/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Your Company Got Breached: the Hour-by-Hour Plan for the First 72 Hours
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/11/
UR  - https://worldngayon.com/data-breach-response-plan/
Y2  - 
ER  -