The First 72 Hours After a Breach

The first 72 hours after a breach decide most of what it will cost. The expensive mistakes usually belong to the victim, not the intruder: a wiped laptop, a rebuilt server with no image taken, a notification deadline discovered on day nine.

I work these incidents in a fixed order: isolate, preserve, notify, remediate. Everything below is written for an organization with no security staff, one IT person, and a business that has to open on Monday.

Two facts make the first three days harder than the usual advice admits. Most small companies sit under more than one notification regime at once, and none of the clocks start when the investigation ends. They start when you know enough to believe something happened, usually before you know what was taken.

Name what you actually have

“Hacked” covers at least three situations, and they call for different first hours.

• Account takeover. Someone is inside a mailbox, an identity provider, or an accounting system. Nothing is encrypted. The attacker reads invoices, changes bank details, and waits for a payment to clear.
• Ransomware or extortion. Files are encrypted, backups were targeted first, and data was often copied out before encryption so the demand has two levers.
• Quiet access. No encryption, no note, no obvious symptom. Credentials and customer records are gone, and you learn about it from a customer, a fraud victim, or a journalist.

The FBI’s Internet Crime Complaint Center logged 1,008,597 complaints in 2025 and $20.877 billion in reported losses, a 26% increase over 2024 (2025 Internet Crime Report, April 2026). Business email compromise accounted for $3.05 billion across 24,768 complaints, the shape most small companies actually meet. Ransomware produced 3,611 complaints and $32.3 million in adjusted losses, a figure the report says excludes lost business, so read it as a floor. What the basic controls cost a small company is the subject of The Threat Floor.

Hours 0 to 4: isolate, and know what isolation breaks

Containment comes first: every hour of continued access adds scope you will later have to notify about. CISA’s #StopRansomware Guide (October 2023) is specific about method: if several systems or subnets appear affected, take the network offline at the switch level rather than chasing cables host by host.

The guide carries a detail most responders learn the hard way. Isolate in a coordinated way and agree on out-of-band communication, by phone or in person, because an intruder who is watching your mail and chat will notice a sudden drop in traffic and may accelerate, deleting logs or deploying encryption before you finish.

Do the work from a device that was never on the compromised network, and assume the attacker can read anything sent through your own mail system. That rules out coordinating by email and drafting the customer notification on the tenant you are investigating. It also rules out the instinct to reset every password first, because a reset from a compromised machine hands over the new credentials. Revoke sessions and refresh tokens at the identity provider, disable the accounts you know are abused, and reset later from a clean device.

What isolation should not destroy is the machine’s state. Powering off a server to stop the spread also stops everything held in memory. CISA’s guide says it plainly: powering down prevents the organization from keeping infection artifacts and evidence stored in volatile memory, and belongs only to cases where the network cannot be segmented another way.

Hours 0 to 4: preserve what a rebuild erases

The guide puts cloud snapshots inside containment: snapshot volumes for a point-in-time copy to review later. Apply that habit before anything is rebuilt, into storage that is not joined to the domain and not reachable with credentials the attacker already holds.

• Full disk images of servers, domain controllers, and any endpoint showing signs of compromise.
• A memory capture from hosts running remote-access tooling or processes nobody can explain. CISA’s list of what investigators want includes live RAM capture and images of infected systems.
• Authentication records: identity provider sign-ins, MFA events, VPN sessions, and the mailbox audit log. For a business email compromise, that log is where the incident becomes visible at all.
• Network records: firewall, proxy, DNS, and remote access logs.
• The ransom note, the encryption binary, and any chat transcript. The guide’s instruction is literal: do not remove the readme file, because decryption may depend on it.
• A written timeline of who touched which system and when, with a SHA-256 hash for every image.

NIST treats this as a control rather than an afterthought (SP 800-61r3, April 2025): incident data and metadata are collected with integrity and provenance preserved, then retained under the organization’s evidence procedures. The same document warns that skipping the analysis step, or doing it superficially, “may cause underestimation of the incident’s magnitude, thus allowing the incident to continue indefinitely on other targets without the organization’s knowledge or monitoring.”

A wiped disk is the most expensive shortcut on that list, and the bill arrives in three places. You cannot say what was taken, so you are guessing on every notification decision, in both directions: too narrow and you under-notify, too broad and you tell customers their data is gone when it may not be. You lose the entry path, so you cannot show the problem is fixed, and the same access tends to return within weeks. And you hand your insurer and your lawyer an inference instead of a record, in the one part of the incident they will pay to examine.

Forensics on a rebuilt machine is possible, but it becomes reconstruction from firewall logs, backups, and cloud audit trails, billed hourly, ending in hedged conclusions. An image captured in hour two costs a few hundred gigabytes of disk.

Hours 4 to 24: four questions that start every clock

Every notification duty hangs off four answers: what data, whose data, how many people, and where they live. You will not have all four by hour 24. You need enough to decide who is in scope, and a record of when you had that much.

1. What categories of data were present, and which were actually accessed? A file share with payroll and one with marketing decks trigger different duties.
2. Whose data is it? Employees, customers, patients, students, and EU residents each bring a separate regime.
3. How many people? Several statutes switch on at 500 individuals, and one of them switches on at 1,000 for credit bureau notice.
4. Where do they live? State law follows the resident, not your office address.

The statutes agree on when the clock starts and disagree on what to call it. HIPAA starts at discovery, the first day the breach was known or would have been known with reasonable diligence (45 CFR 164.404). Florida starts at “the determination of the breach or reason to believe a breach occurred.” The GDPR starts when you become “aware.” Delaware at “determination.” Washington at “discovered.” None of those phrases mean “when the report is finished.” The rest of the state rules are mapped in A Practical Map of US Data Privacy Law.

That is where small organizations lose the argument months later. Notice can be supplemented: Florida allows 15 additional days to notify individuals when good cause is given to the department in writing, and Washington requires the attorney general notice to be updated when information was unknown at the time it was due. Nobody expects a complete account on day two, only the notice you could give on day two.

Hours 4 to 24: who to call, and in what order

Call the insurer before the forensic firm. Most policies carry a notice condition and a panel of approved responders, and work outside that panel is the easiest claim for a carrier to dispute. The policy also pays for what you cannot buy at hour 30: counsel, a negotiator, credit monitoring, sometimes the ransom.

Then outside counsel, who can direct the investigation so the findings sit behind privilege. Then the incident response firm, engaged by counsel where the insurer’s panel allows it.

File an FBI report through IC3 the day you confirm the incident. It costs nothing, timestamps the case, and if money has moved, speed is the point: IC3’s Recovery Asset Team works wire fraud through the Financial Fraud Kill Chain, and the process depends on complaints arriving quickly. Call the local FBI field office as well when the incident is ransomware or a transfer is in flight. CISA takes voluntary reports at cisa.gov/report.

Do not negotiate with the attacker yourself, and do not let an IT provider do it for you. Use counsel and the insurer’s negotiator, who have seen this playbook before.

Hours 24 to 72: the clocks you are actually on

There is no single compliance switch. The regime that applies to you depends on what kind of data you hold, where the people live, and what kind of company you are.

Regime	Who it covers	Deadline	Clock starts
GDPR Article 33	Organizations handling EU/EEA personal data	72 hours to the supervisory authority; individuals without undue delay when risk is high	Becoming aware
SEC Form 8-K Item 1.05	US public reporting companies	4 business days	Determination that the incident is material
FTC Safeguards Rule, 16 CFR 314.4(j)	Non-bank financial institutions: tax preparers, mortgage brokers, collection agencies, others	30 days to the FTC	Discovery of an event affecting 500 or more consumers
HIPAA, 45 CFR 164.404	Covered entities; business associates notify them	60 calendar days to individuals; HHS on the same clock for 500 or more	Discovery
FTC Health Breach Notification Rule, 16 CFR 318.4	Health apps and personal health record vendors outside HIPAA	60 calendar days; FTC notice in the same window for 500 or more	Discovery
Fla. Stat. § 501.171	Anyone holding Florida residents’ personal information	30 days to the department for 500 or more; individuals without unreasonable delay, with a 15-day extension for written good cause	Determination or reason to believe
RCW 19.255.010	Anyone holding Washington residents’ personal information	30 calendar days to individuals; attorney general within 30 days for more than 500 residents	Discovery
6 Del. C. § 12B-102	Anyone holding Delaware residents’ personal information	60 days to individuals; attorney general in the same period	Determination
CIRCIA	Covered critical infrastructure entities	72 hours for a covered incident, 24 hours for a ransom payment, once the rule takes effect	Not in force as of publication

Three rows carry more weight. The SEC row applies to public companies, but the four-business-day standard has migrated into vendor contracts, so a private company can inherit it by signature. The HIPAA and health-app rows both run to 60 days, the longest clock here and the one most likely to be eaten by an investigation that began on day one. And the federal reporting law for critical infrastructure is not yet in force: as of publication, CISA’s page says the agency “continues to work on the final rule,” after town halls in June 2026 and funding lapses that CISA says affected its rulemaking.

If you sell into Europe or employ people there, Article 33 gives you 72 hours from awareness to the supervisory authority, unless the breach is unlikely to result in a risk. Article 34 requires telling affected people without undue delay when the risk is high. Processors carry a separate duty to tell controllers without undue delay, which is the clause that catches small vendors holding someone else’s data.

Then there are the clocks no statute mentions: the notice condition in your cyber insurance policy, your merchant or payment processor agreement, and the vendor contracts where you promised a customer notice faster than any regulator requires. Read all three this month. They bind you sooner than the law does.

Hours 24 to 72: rebuild, rotate, and the payment question

Remediation comes last because remediation destroys evidence. Once the images and logs are secured, rebuild from known-good media rather than cleaning in place. A cleaned server is a server you cannot vouch for, and reinfection after an incomplete cleanup is common enough that I treat it as the default outcome.

Rotate credentials in an order that matches how attackers persist: identity provider sessions and refresh tokens first, then domain credentials, then service accounts, API keys, and certificates, then the OAuth grants and SaaS tokens nobody remembers approving. If Active Directory was touched, the krbtgt account needs to be reset twice, because a single reset leaves valid tickets in circulation.

On payment, the agencies that wrote the ransomware guide do not recommend it: paying does not ensure decryption or that data will not be leaked, and it can raise sanctions risk. That decision belongs to your insurer and counsel with the FBI in the room, not to the IT provider at hour 40. What you can do before then is preserve what makes the decision informed: the note, sample files, the deadline, and the actor’s claims.

What this means for operators

The first 72 hours are a project-management problem under uncertainty, and they reward decisions made earlier. The ones who come through cheaply rarely have the most tooling. They are the ones who already knew who could take the network down, who calls the lawyer at 2 a.m., and what gets imaged before anything is rebuilt.

Three costs dominate, and the first day sets all three. Notification scope depends on logs and images you either have or do not, downtime depends on whether you rebuild cleanly the first time, and the forensic bill depends on how much reconstruction is needed. None of that is settled by the security product you bought, which is why the global averages in IBM’s breach report are background for your planning rather than an input to it.

It is also why the order is worth defending when a senior manager wants to restore backups at hour three. Restoration feels like progress, and it overwrites the evidence that decides who you must call and whether the intruder returns. More of this is filed under cybersecurity.

What to do

1. Write a one-page decision card. Names and mobile numbers for the insurer’s claims line, outside counsel, the IR firm, the bank’s fraud desk, the FBI field office, and whoever can disconnect the company from the internet, on a page posted where the on-call person will find it at 2 a.m.
2. Pre-authorize isolation and imaging in writing. Say who may pull the network, what gets imaged first, and where images go, so nobody negotiates permission mid-incident.
3. Turn on the logs you will need and keep them for a year. Identity provider sign-ins and MFA events, mailbox audit logs, EDR telemetry, firewall and VPN logs, cloud audit trails. A 30-day retention window is a 30-day memory.
4. Build the notification matrix before you need it. Fill in the regimes that apply to your data, the person who owns each notice, and the counsel who reviews it.
5. Read three documents this month: your cyber policy’s notice condition, your merchant agreement, and the security schedule in your largest customer contract. Each may set a shorter deadline than any statute.
6. Name the person who calls the bank. Wire recalls succeed on speed, and whoever can authorize the call is rarely the one who notices the fraud.
7. Rehearse twice a year with the people who will actually be woken up, including the owner or CEO. A tabletop that only involves IT tests the part of the response that was never the problem.
8. File the IC3 report the day you confirm. It costs nothing, timestamps the incident, and for wire fraud it is the mechanism that gives money a chance of coming back.

This quarter, decide two things and write them down: who has authority to disconnect the company from the internet, and who signs the first notification. Those two names decide whether the next 72 hours run as a response or a scramble, and neither requires a budget line.

Sources

1. 2025 Internet Crime Report — FBI Internet Crime Complaint Center, 2026-04.
2. #StopRansomware Guide — CISA and MS-ISAC, 2023-10.
3. Incident Response Recommendations and Considerations for Cybersecurity Risk Management (NIST SP 800-61r3) — NIST, 2025-04.
4. 45 CFR 164.404, Notification to individuals — eCFR, accessed 2026-11-02.
5. 16 CFR Part 318, Health Breach Notification Rule — eCFR, amended 2024-07-29.
6. 16 CFR Part 314, Standards for Safeguarding Customer Information — eCFR, amended 2024-05-13.
7. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — Federal Register, 2023-08-04.
8. Regulation (EU) 2016/679, Article 33 — EUR-Lex, 2016-04-27.
9. Fla. Stat. § 501.171, Notice of security breach — Florida Senate, 2025.
10. RCW 19.255.010, Notice of security breach — Washington State Legislature, accessed 2026-11-02.
11. 6 Del. C. ch. 12B, Computer Security — Delaware Code, accessed 2026-11-02.
12. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) — CISA, accessed 2026-11-02.
13. FBI field offices — FBI, accessed 2026-11-02.