A breach: what to do in the first 24 hours
Photo: Avila Ops Tecnologia
In the first 24 hours of a breach, the order is: contain, record, assess, notify. Containing means closing the door through which the data escaped. Recording means noting what, when, how much, and who. Assessing means deciding whether there is significant risk to people. Notifying means informing the ANPD and data subjects when there is, as required by article 48 of the LGPD (Law 13.709/2018). What you do not do: erase traces, wait for it to pass, or notify customers with vague wording.
Small businesses often lose the first day to panic or denial. And the first day determines whether the case becomes a resolved incident or a public affair. Customers forgive mistakes handled candidly. They do not forgive finding out through a scam they received.
Hours 0 to 2: how do you contain it?
Close access before understanding everything. If the cause was a password, change it and enable two-step verification. If it was a publicly shared spreadsheet link, restrict sharing. If it was a lost phone, wipe it remotely and block the SIM with the carrier. If the website was hacked, take it offline or ask the host to block it, and change all dashboard passwords.
One rule: do not delete anything except unauthorized access. Access logs, suspicious emails, screenshots of the open spreadsheet are evidence. You will need them to explain what happened and demonstrate that you acted.
Hours 2 to 8: what should you record, and how do you assess risk?
Open a document and answer with the information you have:
| Question | Why it matters |
|---|---|
| What data leaked? | Name and email pose one risk; CPF, passwords, or health data pose another |
| How many people? | Changes the communication and what the ANPD requests |
| How long was it exposed? | A spreadsheet open for a year differs from a misdirected email yesterday |
| Who accessed it or could have accessed it? | One incorrect recipient or the entire internet |
| Has it been contained? How? When? | Evidence of diligence |
Use this to assess risk. Data enabling scams, fraud, or embarrassment poses significant risk: CPF with phone number, password, banking details, health data, an identity document photo. Data the person already publishes, such as a name and business email, tends to fall below that threshold, but record it anyway. If in doubt, treat it as significant.
Hours 8 to 24: whom should you notify, and what should you say?
Two recipients. The ANPD, through the form on its website, when risk is significant. Resolution CD/ANPD No. 15/2024 established a three-business-day deadline from learning of the incident (double for small processing agents), so the first 24 hours are for gathering information, not waiting. If you do not yet know everything, report what you know and supplement later; the ANPD itself provides for this.
Data subjects, within the same deadline, with a direct message. The text has five parts: what happened, which of their data was affected, what you have already done, what the person should do (change passwords, distrust messages in the company’s name), and a channel for questions. Avoid “as a precaution, we inform you there may have been”; write “on March 10, a spreadsheet containing the names, phone numbers, and CPFs of 240 customers became accessible through a public link. We closed access that same day.”
If a crime occurred, such as hacking or extortion, file a police report. It also proves you took the case seriously.
Example: a language school discovered its enrollment form was sending data to a compromised email account. Within four hours, it changed the password, enabled two-step verification, and redirected the form. Within eight, it had the list of 60 affected students. Within 20, each received a message describing the incident and guidance. Nobody canceled.
What to do now
If you are reading this during an active breach, return to the top and start with containment. If you are reading beforehand, write your plan on one page today: who does what, where passwords are stored, the ANPD form link, and the customer message template. Having this written saves the most valuable hours. An assessment of what is exposed, in one conversation: avilaops.com/contato or contact us on WhatsApp: wa.me/5517997811471. What counts as a breach is covered in What a data breach is.
Frequently asked questions
Does every breach need to be reported to the ANPD?
No. The law requires notification when there is significant risk or harm to data subjects. An email sent with a visible recipient list to a few people usually falls below that. For passwords, banking data, health data, or children’s data, notify.
Should I notify customers even if I am not sure anyone accessed the data?
If the data was exposed and poses significant risk, yes. You cannot prove nobody accessed it, and customers have the right to protect themselves. See their rights in Who the data subject is and what rights they have.
Is paying the ransom in a ransomware attack worthwhile?
Authorities’ general guidance is not to pay: there is no guarantee of recovery, and it funds the next attack. Restore the backup, notify, and file a police report. If you have no backup, that is the first item after the crisis.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.