Data Breach Response Checklist: What to Do in the First 24 Hours

So you think you’ve had a data breach. Before you do anything else, understand this: what happens in the next 24 hours will shape what the next six months look like for your business. Evidence will either be preserved or lost, and regulators will be notified on time or they won’t. Customers will hear about it from you first, or they’ll hear about it from someone else.

This data breach response checklist is built for Georgia businesses that don’t have a dedicated security team on retainer. It walks through an incident response plan for data breach situations you’re most likely to face, hour by hour, so you know what to do while the situation is still moving.

What Counts as a Data Breach?

A data breach means someone got access to protected information they shouldn’t have. The obvious case is a hacker pulling customer records off your systems. But it also covers a lost company laptop with client files, an employee emailing sensitive data to the wrong person, a misconfigured cloud folder that turned out to be public, or a vendor breach that exposed your data along with theirs.

Hours 0–4: Contain and Preserve 

The first job is to stop the bleeding; everything else can wait.

Isolate affected systems, but don’t power them off. Unplug the network cable or turn off Wi-Fi on the device. Powering down wipes the system’s memory, which is where forensic investigators find the evidence to piece together what happened. 

Document what you saw and when. Grab a notebook or open a fresh document on a clean machine, and start timestamping. When did you notice it? What tipped you off? Who did you tell first? Screenshots of error messages help too.

Don’t delete anything, including suspicious files. Attackers sometimes leave breadcrumbs that lead to the intrusion path, and your forensic contractor will thank you for not wiping them.

Loop in your internal decision-maker. If you’re not the owner, get them on the phone now. Response decisions have financial and legal consequences, and they need to be at the table. 

A note on backups: If this turns out to be ransomware, your backup situation determines everything. If your only backups live on the same network the attacker just compromised, they’re likely encrypted too. Offline backups are the difference between paying a ransom and restoring from a clean copy. If you haven’t looked into how an air-gapped backup approach protects against this, put it on the list for after the fire’s out. 

Hours 4–12: Assemble Your Response Team 

The next few hours should be focused on calling in the right help. 

Name a breach lead. At a small- to mid-sized business, this is usually the owner or COO. One person makes final calls so decisions don’t get stuck in committee.

Call your cyber insurance carrier first. Most cyber policies require you to use their approved forensic vendors and legal counsel. Hire your own before the carrier signs off and you may end up paying those bills out of pocket.

Loop in outside counsel. Your regular business attorney can help even if they’re not a specialist. They’ll advise on notification obligations, preserve attorney-client privilege over the investigation, and manage communications with regulators.

Bring in a forensic IT contractor. They’re the ones who figure out how the attacker got in, what they touched, and whether they still have access. If you don’t already have one on retainer, ask your carrier or attorney for a referral.

Hours 12–24: Assess Scope and Prepare for Notification 

Your team should have a working picture of the incident by now. Now you need to figure out who was affected and start preparing to notify them. 

Determine what data was affected. Was it just customer names and emails? Or did it include sensitive categories like Social Security numbers, financial account information, health records, or payment card data? The type of data determines which laws apply and how urgent your timeline is.

Identify who was affected. Not just how many people, but where they live. Georgia residents put you under Georgia law, residents of other states put you under theirs, and a breach affecting customers in multiple states means multiple compliance tracks running at once.

Draft (do not send) your notification language. Work with counsel on the wording before anything goes out the door. What you say publicly in the first 48 hours can affect regulatory investigations and civil liability for years.

Prepare your internal communications. Your employees are going to find out something happened. If they hear it from a customer or a news story before they hear it from you, you’ve got a second problem on top of the first one. Get a plain-English message ready for the team.

Georgia Data Breach Notification Law: What CSRA Businesses Need to Know 

The Georgia data breach notification law is found in O.C.G.A. §§ 10-1-910 through 10-1-912. It applies to any business or agency that holds computerized personal information about Georgia residents. “Personal information” here means a name paired with something like a Social Security number, driver’s license number, or financial account credentials.

The law kicks in when that information gets acquired by someone unauthorized to have it, and when it wasn’t encrypted. Once you confirm that happened, you have to notify affected Georgia residents “in the most expedient time possible and without unreasonable delay.” You can delay for a law enforcement investigation or to figure out the scope of the breach. You can’t delay indefinitely.

Depending on the size of the breach, you may also need to:

• Notify consumer reporting agencies, if more than 10,000 Georgia residents are affected
• Notify the Georgia Attorney General’s office in certain cases
• Report to federal regulators, if you’re in a regulated industry like healthcare (HIPAA) or finance (GLBA)
• Follow the notification laws of other states, if the breach touched residents outside Georgia

Data Breach Crisis Communication Plan: What to Say and When 

How Augusta Data Storage Fits Into Your Response

If you’re already an Augusta Data Storage customer, some pieces of this response are handled by our existing services. Fast data breach incident response depends on the groundwork laid before anything happened.

Off-site physical records. Digital breaches don’t touch paper files stored in our NARA-certified facility. Your off-site documents stay insulated from whatever’s happening on your network.

Certified destruction of compromised materials. If physical records got exposed and can’t be safely kept, our NAID AAA certified shredding handles the destruction. You get a Certificate of Destruction for your incident report.

Air-gapped backup restoration. Our climate-controlled media vault stores offline backup tapes that aren’t connected to your network. If ransomware locks up your live systems, an offline copy is your route back.

Local, same-day response. We’re an Augusta company. When you need physical records pulled, delivered, or destroyed on short notice, our team is a phone call away.

After the Dust Settles: Building for the Next One

Once things slow down, most business owners have the same reaction: this can’t happen again. Act on that instinct while the memory is fresh. 

Start with a written disaster recovery plan. Most businesses that get breached didn’t have one, or had one nobody had looked at in years. A working plan spells out who does what, in what order, when the next incident hits. Our step-by-step guide to building a disaster recovery plan for business records is a solid starting point. 

Pressure-test the plan before you need it. A DRP that’s never been through a drill is a document, not a plan. Walk through a scenario, see what falls apart, and fix it before it fails you for real. Here’s how to stress-test your disaster recovery plan without needing a real disaster to do it. 

Keep an eye on what’s coming. The threat landscape shifts every year, and what was a top risk two years ago has been replaced by newer angles in 2026. Our rundown of the top information security risks for 2026 is worth a quarterly read. 

Invest in your team. Most breaches start with someone clicking something they shouldn’t. Regular training and a plain-language security policy are worth more than another expensive piece of software. We’ve written more on the importance of employee education on information security. 

Ready to Build a Response Plan Before You Need One?

The best time to build a data breach response playbook is before you need one. If you’re an Augusta or CSRA business owner who wants to talk through how off-site storage, offline backups, and certified destruction fit into your incident response, the Augusta Data Storage team is here for the conversation. Reach out or give us a call at (706) 793-0186 to set up a records security review.

Frequently Asked Questions