A Data Breach Just Happened to You - Now What? A Response Playbook

Phase 1: Contain (first minutes)

Stop the bleeding before you understand the wound. That means isolating affected systems - disconnecting them from the network if needed, disabling compromised accounts, and stopping whatever automated process is running. Containment can be blunt; refinement comes later.

One warning: do not 'fix' things by deleting files or reinstalling systems yet. Every deletion can destroy evidence you'll need to understand what happened.

Phase 2: Preserve evidence

Record what you know: time, systems, accounts, messages. Keep logs, emails and alerts. If you can, take a forensic image of affected machines rather than working on the originals. Chain of custody matters if the matter ever reaches insurers, regulators or courts.

Our guide on preserving evidence walks through this in practical detail.

Phase 3: Assess the blast radius

What data was involved? Customers, staff, financials, intellectual property? How many records? Where did it go? Answering these questions determines whether you have a notifiable privacy breach under the Privacy Act 2020 and what you owe affected people.

Phase 4: Notify and communicate

If serious harm is likely, notify the Privacy Commissioner and affected individuals. Communicate internally with a single spokesperson so messages stay consistent. Honesty builds trust; spin destroys it.

Phase 5: Recover and learn

Restore from tested backups, re-secure the environment, and then - the part most businesses skip - find out why it happened and fix the root cause. A breach you learn from is expensive. A breach you repeat is a pattern.