Data breach and exposure
Think sensitive data was exposed?
In plain terms, a data breach is unauthorized access to, or disclosure of, sensitive information such as customer, patient, employee or financial records. If you think it has happened, call our 24/7 incident line at 1-650-300-7557. ACS Cyber helps you contain the exposure, investigates in-house what data was involved, whose it was and how and when it was accessed, and gives your counsel the facts they need.
01
Contain the exposure
Close the open share, disable the compromised account or isolate the affected system. Change as little else as possible until evidence is preserved.
02
Preserve the evidence
Keep logs, audit trails, affected systems and any messages from the attacker. Deleting data to limit the damage also destroys evidence.
03
Bring in legal counsel early
Counsel advises on notification obligations and on how the investigation should be structured and documented.
04
Notify your insurer
Check your policy’s notice requirements and call your carrier’s claims line before significant costs are incurred. Do it early: many policies require prompt notice or approved responders.
05
Hold public statements
Avoid public or customer statements until the facts are known and counsel has reviewed them. Early statements are hard to correct.
- Stolen or copied files
- Exposed cloud storage or shares
- A compromised mailbox holding sensitive data
- Lost or stolen devices
- Threats to publish your data
Not a client yet? You can still call. Our incident line is answered 24/7 for organizations nationwide.
First steps
Do this now, and what to avoid
Early decisions shape both the investigation and your obligations. If our team, your insurer or your counsel advises differently, follow their direction.
| Do this now | Avoid this |
|---|---|
| Contain the exposure and record what you changed | Wiping systems or deleting data to clean up |
| Preserve logs, audit trails and affected systems | Letting log retention settings delete the records you need |
| Involve legal counsel before deciding on notifications | Notifying, or deciding not to notify, before the facts are known |
| Notify your insurer under your policy’s terms | Engaging vendors in ways your policy may not permit |
| Route communications through a small, defined team | Public statements, social media posts or speculation |
| Report criminal activity to the FBI (IC3) or CISA, with counsel’s input | Contacting or paying anyone who claims to hold your data without counsel and insurer input |
In-house forensic investigation
What data, whose, how and when
Notification obligations depend on the facts: which data elements were involved, whose data it was, where those people live, and whether the data was actually accessed or taken. Our in-house forensic investigation is designed to answer the technical side of those questions.
We examine access logs, audit trails, file and database activity, cloud storage permissions, email and network records to determine the scope. Evidence is handled with documented chain of custody, and findings are written so your counsel and insurer can use them. See how our incident investigations work.
- How the exposure happened, and when it started and ended
- Which systems, files, databases or mailboxes were involved
- Which data elements were exposed, such as names, account numbers, health or financial information
- Whose data it was, so counsel can assess which laws apply
- Whether data was viewed, copied or taken, where the evidence allows
Structured with your counsel
Many organizations have counsel engage the forensic investigation.
Ask your counsel how they want the investigation scoped, documented and reported, and we will work within that structure.
Counsel, insurer and compliance
Supporting your counsel’s notification decisions
Whether, when and whom to notify is your organization’s decision, made on your counsel’s advice. Depending on the data and the people affected, obligations can arise under the HIPAA Breach Notification Rule, state breach-notification laws, the FTC Safeguards Rule, PCI DSS and contractual notice clauses. Many of these set deadlines, so involve counsel early.
We support counsel with evidence, timelines and affected-data analysis. We coordinate with your insurer when you authorize it, working alongside insurer-assigned response firms where your policy permits. We do not provide legal advice or make notification decisions.
- Affected-data analysis by data type and population
- A documented incident timeline
- Technical facts for notification letters, reviewed by counsel
- Documentation to support insurance claims
Rules your counsel may consider
- HIPAA Breach Notification Rule
- State breach-notification laws
- FTC Safeguards Rule
- PCI DSS
- ABA Model Rules duties
- Contractual notice clauses
Remediation
Remediate, monitor and recover
We help close the path the data took: fix the misconfiguration, remove attacker access, rotate exposed credentials and keys, and tighten permissions. We can also monitor for signs of further access or misuse while the business returns to normal. See post-incident recovery and protection for the full path.
Where systems or cloud configurations need rebuilding, Atlantic Computer Systems, our parent company, provides managed IT to carry the fixes through. Learn about Atlantic Computer Systems.
Prevention
Reduce the chance of another exposure
Exposures often trace back to access that was too broad, a gap nobody saw or an account that was not protected well enough. These services address each one.
Risk and compliance readiness
Gap assessments and remediation aligned with the HIPAA Security Rule, PCI DSS, the FTC Safeguards Rule and NIST CSF 2.0.
24/7 managed detection and response
Our in-house SOC watches endpoints, identity, email, cloud and servers for signs of unauthorized access and data theft.
Vulnerability management and penetration testing
Find exposed systems and misconfigurations, with in-house penetration testing to confirm what an attacker could reach.
vCISO and incident-response planning
Data mapping, access policies, a written incident-response plan and tabletop exercises.
Cloud and Microsoft 365 controls
Sharing settings, access reviews and sign-in protections that limit what one compromised account can reach.
Security awareness training
Practical training on handling sensitive data, sharing files safely and spotting phishing.
FAQ
Data breach questions
Contain the exposure, preserve evidence, involve legal counsel and notify your cyber insurer. Avoid public statements until the facts are known. Then commission a forensic investigation to establish what data was involved, whose it was and how it was accessed. ACS Cyber’s 24/7 incident line is 1-650-300-7557.
It depends on the facts and the law, and it is a decision to make with your legal counsel. Obligations depend on the type of data, whose it was, where those people live and what your contracts require. Our investigation provides the evidence counsel needs.
We examine access logs, audit trails, file and database activity and network records to reconstruct what was reached and when. Where the evidence allows, we determine whether data was viewed, copied or taken.
Your organization decides, on the advice of legal counsel. We do not make that determination; we provide the technical findings it depends on.
Usually not before counsel has reviewed the facts. Early statements are often incomplete and difficult to correct. Many organizations prepare a short holding statement with counsel in case they are asked.
Yes, on the technical side. For healthcare organizations, we provide the forensic facts counsel needs to apply the HIPAA Breach Notification Rule, including what protected health information was involved and how it was accessed. See our healthcare cybersecurity page. For ongoing HIPAA work, Atlantic Computer Systems, our parent company, offers HIPAA compliance program support and publishes HIPAA guides and checklists.
24/7 incident line
Worried about a data exposure right now?
Call 1-650-300-7557 and speak with our incident team. If the incident is over and you want to reduce the chance of another, book a free 30-minute consultation. For other incidents, see how we help after any compromise.