loading_
Found your data in a breach? Don't worry. Paste the details below, and our AI advisor will give you a personalized action plan to secure your accounts.
It gives you a calm, ordered set of next steps for the situation you describe, aimed at the first hours when the instinct is either to freeze or to start pulling cables.
The advice is deliberately pragmatic and prioritises containment, evidence and decision-making over technical depth, because in the early stages those are what determine how bad the incident becomes.
Declare it, even provisionally
The most common and most expensive failure is that nobody declares. Hours pass while everyone investigates reasonably. Make declaration cheap and explicitly reversible, and a stood-down incident a good outcome rather than an embarrassment.
Preserve evidence before you clean up
The instinct to rebuild immediately destroys the information you need to understand what happened and to satisfy an insurer or regulator later.
Start the regulatory assessment in parallel
Do not wait for the technical picture to settle. Someone should be asking whether personal data is involved and when awareness began, from the start.
Write down decisions as you make them
A timestamped record of who decided what and when is the single most useful artefact afterwards, for the debrief, the insurer and the regulator.
It is general guidance, not advice on your specific situation, and it cannot see your systems. It cannot tell you whether you have been breached, how far an attacker got, or whether the incident is notifiable. If you are dealing with something live and serious, get qualified incident response support and speak to your insurer.
Declare it, provisionally if necessary, so that someone is clearly in charge and the response stops being a set of parallel guesses. Then preserve evidence before rebuilding anything, start the regulatory assessment in parallel rather than after, and write down decisions with timestamps as you make them.
Not reflexively. Disconnecting can destroy evidence you will need and can escalate the disruption beyond what the incident itself caused. Containment decisions need someone with the authority to weigh operational impact against spread, which is exactly the decision most organisations have never rehearsed.
It depends on whether personal data is involved and on your sector obligations. Under UK GDPR the ICO must be notified within 72 hours of awareness where the risk threshold is met. Because the awareness point is a judgement, start that assessment early rather than treating it as a final step.
No. This is orientation for the first hours, aimed at organisations without a security team. If the incident is live and material, engage qualified incident response help and notify your insurer, who may require you to use their panel.