How to Detect and Respond to a Data Breach in the First 24 Hours

The average cost of a data breach reached $4.44 million in 2025. Most of that cost is not the breach itself. It is the hours lost to disorganised response, the regulatory fines from missed notification windows, and the customer trust destroyed by poor communication. A documented response plan changes all three.

Having a data breach response plan before a breach occurs is the single most cost-effective investment in cybersecurity a business can make. The IBM Cost of a Data Breach Report consistently shows that organisations with an incident response plan and a trained response team contain breaches faster and at lower total cost than those improvising their way through an incident.

This guide covers the full 24-hour data breach response window from detection through initial notification, including the GDPR 72-hour regulatory requirement.

How to Detect a Data Breach Early

The average time to identify a data breach in 2025 was 194 days. Most organisations do not discover breaches from their own monitoring. They discover them from external notifications: a vendor report, a law enforcement notification, or a customer flagging suspicious activity involving their account.

The detection signals worth monitoring proactively include: unusual outbound data traffic volumes, failed login attempts at scale, unexpected privilege escalation events in access logs, alerts from endpoint detection tools about unusual process behaviour, and anomalous database query patterns. Each of these is detectable before data leaves your environment if monitoring is in place.

SIEM alerts: Security Information and Event Management systems aggregate log data from across your infrastructure and flag pattern anomalies. A SIEM is not a guaranteed breach detector, but it is the most practical tool available for identifying suspicious behaviour before it becomes a confirmed breach.

Dark web monitoring: Services that scan dark web forums and marketplaces for credentials or data matching your domain can provide early warning that data from your systems is circulating externally. This is often how organisations discover breaches they had not yet detected internally.

User behaviour analytics: Tools that baseline normal user behaviour and flag deviations. A finance employee suddenly accessing HR records at 2 AM is anomalous. Behaviour analytics surface these patterns for human investigation.

Hour 0 to 4: Confirm and Contain

1. Confirm the breach is real. Not every security alert is a confirmed breach. Distinguish between an indicator of compromise and a confirmed incident before activating your full response plan. A suspicious log entry warrants investigation. A confirmed data exfiltration warrants immediate escalation.
2. Assemble the incident response team. Your IR team should be pre-defined: typically a technical lead, a legal representative, a communications lead, and a senior decision-maker with authority to approve significant actions. Do not make personnel decisions mid-incident.
3. Preserve evidence. Before taking any containment action, capture log files, screenshots, and system states. Forensic evidence captured before systems are shut down or wiped is irreplaceable. Destroying evidence through hasty containment actions is a common and expensive mistake.
4. Contain the spread. Isolate affected systems without shutting down the entire network unless the situation demands it. Change compromised credentials immediately. Revoke access for any accounts that appear to have been used in the attack. If cloud infrastructure is involved, snapshot affected instances before termination.

Hour 4 to 12: Assess and Notify Internally

1. Assess the scope. What data was accessed or exfiltrated? Whose data is it? How sensitive is it? What systems were affected? This assessment determines notification obligations and the severity of your regulatory exposure.
2. Identify notification obligations. The notification requirements depend on the jurisdiction and the type of data involved. GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals’ rights and freedoms. Most US states require notification to affected individuals within 30 to 90 days. Some states require notification within 30 days.
3. Notify leadership and legal. Your CEO and legal counsel need to know about any breach that may require regulatory notification or that could result in material business impact. Do not filter bad news. Give them the facts as known at this stage with explicit acknowledgement of what is still unknown.
4. Document everything. From this point forward, maintain a written timeline of every action taken, every decision made, and every communication sent. This documentation is essential for regulatory responses, legal proceedings, and post-incident review.

Hour 12 to 24: Regulatory Notification and External Communication

GDPR’s 72-hour notification clock begins when you become aware of a breach that is likely to result in a risk to individuals. You do not need to wait until the full picture is clear. Notify the supervisory authority with the information available at the time, and update as more information is confirmed.

The GDPR notification should include: the nature of the breach, categories and approximate number of individuals affected, likely consequences, and measures taken or proposed to address the breach.

Notifying affected individuals: If the breach is likely to result in high risk to the rights and freedoms of individuals, you must also notify those individuals directly, without undue delay. This notification should describe the nature of the breach in plain language, the likely consequences, the steps taken to address it, and who to contact with questions.

Public communication: For breaches affecting significant numbers of individuals, a public statement is often appropriate to prevent rumour and speculation from creating reputational damage worse than the breach itself. The statement should be factual, avoid speculation about attribution, and confirm what steps are being taken.

Notifying partners and vendors: If affected data belongs to or is shared with third parties, notify them promptly. Failure to notify business partners in a timely way can expose you to contractual liability in addition to regulatory liability.