A suspected data breach requires a coordinated technical and organizational response. Communications should follow verified findings and help affected people protect themselves. Avoid premature claims that no data was involved, and do not let public messaging delay qualified containment or required notifications.
01
Activate the right team
Identify technical response, operations, privacy or legal advice, customer support, and a communications owner. The FTC’s breach response guidance emphasizes coordinated expertise and preserving evidence. Record when the issue was discovered and how information reaches the team. Do not improvise destructive changes that could erase records needed to understand what happened.
02
Verify impact before describing it
Example: a publicly accessible file contains customer contact details, but access logs are still under review. The existence of exposure and evidence of actual access are different findings. Track both clearly. Ask the technical team which data types, people, systems, and time periods are confirmed, which are estimated, and what remains unknown.
- Keep sensitive findings in a restricted working record.
- Do not attach exposed customer data to a broad internal email.
- Assign responsibility for updating the verified facts.
03
Prepare appropriate notices and support
Notification requirements depend on jurisdiction, data, and circumstances. Obtain qualified review for US and Mexican obligations rather than reusing one country’s template everywhere. Explain confirmed facts, relevant protective steps, and a trustworthy contact route. Review the notice for phishing confusion: recipients should be able to verify it through an established channel without providing unnecessary information.
Frequently asked questions
Should we publish all technical findings to prove transparency?
No. Share what affected people need and what the applicable process requires. Avoid exposing personal data, security-sensitive details, or unverified conclusions in the name of transparency.
Can we wait until every uncertainty is resolved?
Do not assume that. Legal timelines and protective needs may require action before the investigation is complete. Coordinate advisers and use accurate wording about known facts and remaining uncertainty.
Continue with your next step
Related guides on this topic
Sources and policies
Check the current policy before submitting a request.
You do not have to figure out the next step alone.
Share the URLs and explain your concern. We will review the context and explain which options are worth assessing.
Request a confidential reviewOr call (307) 429-2531Educational information, not legal advice. Outcomes depend on the facts and decisions made by third parties.