Small Business Data Breach Checklist: What to Do First

By Steve Levine · Updated November 9, 2026

After a small business data breach, the order matters: stop the damage, preserve the evidence, call your insurer’s breach line before you hire anyone, then work out who you must notify and by when. The Federal Trade Commission’s guide for businesses sets out that sequence, and every US state has its own notification law with its own deadline. The checklist below follows the FTC’s order and flags where insurance changes what you should do.

The first hour: secure, don’t erase

The FTC’s Data Breach Response: A Guide for Business tells you to move quickly to secure your systems and fix the vulnerabilities that caused the breach. Two of its instructions trip people up because they feel contradictory:

Take affected equipment offline, but don’t turn it off. The FTC says to keep machines powered on until forensic experts can examine them. Shutting down can destroy evidence held in memory.
Change credentials immediately. The guide says to update passwords and access credentials, because a stolen login leaves you exposed even after the attacker’s tools are removed.

If physical areas were involved, the FTC also says to secure them and consider changing access codes. If personal information was posted on your website, remove it, and ask search engines and other sites to remove copies.

Small business data breach checklist

Step	What to do	Why it matters
1. Contain	Isolate affected devices from the network; keep them powered on; reset passwords and access	Stops the spread without destroying evidence (FTC)
2. Call your insurer	Use the cyber policy’s breach hotline, or report to your agent if you are not sure you have cover	Many policies require notice and use approved responders; paying a ransom without notice can void cover (NAIC)
3. Assemble the team	Forensics, legal counsel with privacy expertise, IT, communications, HR	The FTC recommends independent forensic investigators and outside privacy counsel
4. Preserve evidence	Keep logs and forensic images; interview whoever found the breach; document everything	The FTC says “do not destroy evidence”
5. Fix the hole	Check vendor access, network segmentation and whether data was encrypted	Determines scope, and whether notice is required under some state laws
6. Notify law enforcement	Local police, or the FBI or Secret Service; IC3 for online crime	The FTC says to call police immediately; also creates a record
7. Work out legal duties	Identify every state where affected people live and check each law	Deadlines and recipients differ by state
8. Notify businesses	Banks or card issuers for stolen account numbers; any client whose data you held	They can monitor for fraud (FTC)
9. Notify individuals	Plain-language notice; one spokesperson; consider credit monitoring	Required by state law where it applies
10. Credit bureaus	Contact Equifax, Experian and TransUnion if Social Security numbers were taken	The FTC advises this; some states require it at volume

Call your insurer before your IT vendor bills you

If you have cyber liability insurance, the policy may require prompt notice and may limit you to responders the insurer approves. The NAIC’s ransomware guidance warns that insurers “typically require notification prior to payment; failure to comply may result in denial of coverage.”

The practical risk is cost recovery. A forensic firm or lawyer you hire on your own may bill at rates the insurer won’t reimburse. The FTC’s cyber insurance page recommends asking whether a policy includes a breach hotline available at all times; if yours does, it is the first call after containment. Our guide to filing a business insurance claim covers what to write down for the adjuster.

If you have no cyber policy, call your agent anyway. Some business owner’s policies carry a limited data-breach endorsement, and you won’t know until someone reads the declarations.

Preserve evidence and investigate

The FTC says to interview the people who discovered the breach, document the investigation, and keep forensic images and logs. Write down a simple timeline as you go: when the incident was noticed, by whom, what was seen, and each action taken. State notification deadlines are usually measured from when you discovered or determined the breach, so the date you write down matters.

While the investigation runs, the FTC tells you to check what access your service providers have, verify any fixes they say they made, and confirm with the forensic team whether data was encrypted. Encryption can change whether notice is required in some states, so get that answer in writing.

Who you must notify, and by when

The National Conference of State Legislatures’ summary of security breach notification laws states that all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify individuals of security breaches involving personal information. The rule that applies is generally the law of the state where each affected person lives, not where your business is based. A shop in one state with online customers in ten states may owe notices under ten laws.

One example: Texas

Texas Business and Commerce Code section 521.053 sets three duties:

Notify affected individuals no later than the 60th day after you determine the breach occurred.
If the breach involves at least 250 Texas residents, notify the Texas Attorney General electronically no later than the 30th day after that determination.
If you must notify more than 10,000 people at one time, also notify the nationwide consumer reporting agencies, without unreasonable delay, of the timing, distribution and content of the notices.

Other states set different deadlines and thresholds, and some require notice to a regulator at lower counts. Check each state’s statute or attorney general’s page rather than assuming the Texas numbers apply.

Federal rules for health and other data

The FTC’s guide notes that breaches of electronic health information may fall under the FTC’s Health Breach Notification Rule or, for HIPAA-covered entities and their business associates, HHS’s HIPAA Breach Notification Rule. Financial institutions and other regulated sectors have their own rules.

What the notice should say

The FTC recommends that a notice:

Describe clearly what you know about how the breach happened and what information was taken.
Say how the thieves have used the information, if you know.
Explain what you have done to remedy the situation and protect individuals.
Give contact details for a named point person.
Tell people how you will contact them in future, so they can recognise phishing that impersonates you.
Point to steps they can take, such as fraud alerts, credit freezes and IdentityTheft.gov/databreach.

The FTC also suggests considering at least a year of free credit monitoring, especially if financial information or Social Security numbers were exposed. Consult law enforcement on timing so the notice doesn’t hamper an investigation.

Report the crime

The FTC says to call your local police immediately, and to contact the FBI or the U.S. Secret Service if local police aren’t familiar with this kind of crime. Online fraud, including business email compromise, can also be reported to the FBI’s Internet Crime Complaint Center; its 2024 report logged 21,442 business email compromise complaints with about $2.77 billion in losses.

Before the next one

CISA’s Cyber Essentials is written for small-business leaders deciding where to start, and the controls it covers are the same ones cyber insurers ask about. Keep a one-page incident sheet with your insurer’s breach hotline, policy number, IT contact and a list of the states where your customers live, so the 60- or 30-day clock never starts while you are still looking for the phone number. A licensed agent or your state insurance department can confirm what your policy requires after a breach.

Sources

Owed money from a settlement? Check what is open at OpenClassActions.com. Caring for someone with dementia? Find practical guides at HelpDementia.com. Working out a skin routine? Evidence-based answers at AcneAdvocate.com. Forgot the name of a movie? Identify it at FindThisMovie.com. Was your data exposed? Track active breaches at DataBreachRadar.com.