Responding to a data breach: the first days

A volunteer's laptop is stolen from a car. A spreadsheet of donors goes to the whole mailing list. Someone logs into the charity's email and starts sending odd messages. Any of these can be a data breach: personal information lost, stolen, or seen by someone who shouldn't see it.

This guide is for the first days after you find out. It follows the Federal Trade Commission's (FTC) Data Breach Response: A Guide for Business, which is written for businesses but works well for a charity. Our guides on cybersecurity basics and data privacy basics cover how to make a breach less likely in the first place.

Day one: stop it getting worse

The FTC's first instruction is to move quickly to secure your systems and fix whatever caused the breach.

• Pick a small response team. Usually your executive director or board chair, whoever looks after your technology, and someone who can handle communications. Keep the group small and the details confidential until you know what happened.
• Get help. The FTC suggests a forensic expert to find out what happened and how far it went, and a lawyer, ideally one with privacy and data security experience. If you have cyber insurance, call the insurer now and check what the policy asks you to do, and how quickly.
• Stop more data leaking. The FTC says to take affected equipment offline, but "don't turn any machines off until the forensic experts arrive," because that can destroy evidence.
• Change passwords. If login details may have been stolen, change them, and turn on two-step login where it isn't on already. The FTC notes you stay exposed until stolen credentials are changed.
• Take down anything posted by mistake. If personal information went up on your website, remove it. Search engines may keep cached copies for a while, so the FTC suggests contacting them to make sure they don't archive personal information posted in error, and searching for your data on other sites.
• Don't destroy evidence. Keep logs, emails and devices as they are. Write down what happened, when, who found it and what you've done, as you go.

Days two and three: find out what happened

Work with your expert to answer:

• What information was involved? Names and emails alone are different from Social Security numbers, bank details, health information or details about children. State laws define which types of information count.
• Whose information? Donors, volunteers, staff, the people you serve? How many, and which states do they live in?
• Was it encrypted? Some laws treat encrypted data differently. California's, for example, covers unencrypted personal information, and encrypted information only if the key or credential that could unlock it was also taken.
• Is it still happening, and is the cause fixed?

The FTC also says to check your service providers. If a database, payroll or email provider was involved, find out what access they have, and if they say they've fixed the problem, verify it.

Who you may have to tell

State notification laws

The FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information. They differ on what counts as personal information, how fast you must act, and which officials to tell. Three examples:

• California. Civil Code 1798.82, as amended from January 1, 2026, requires an individual or business that conducts business in California to notify any California resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, "within 30 calendar days of discovery or notification of the data breach." The notice may be delayed for law enforcement needs, or as necessary to determine the scope of the breach and restore the system. It must be in plain language, titled "Notice of Data Breach," with set headings. If one breach requires notifying more than 500 California residents, you must also send the Attorney General a sample copy of the notice, without personal information, electronically and "within 15 calendar days of notifying affected consumers."
• Texas. The Texas Attorney General says businesses and organizations that have a breach affecting 250 or more Texans must report it to the Attorney General "as soon as practicably possible and no later than 30 days after the discovery of the breach," using the Attorney General's online form, and must also notify the affected people.
• New York. General Business Law § 899-aa says notice to affected people must be made "in the most expedient time possible and without unreasonable delay," and within thirty days after the breach was discovered, with a possible delay for law enforcement needs. You must also tell the state attorney general, the Department of State and the Division of State Police about the timing, content and distribution of the notices. The Attorney General's SHIELD Act page says filing through its breach reporting portal is enough for all three. Since the SHIELD Act, a breach includes unauthorized access to private information, not only someone taking it.

These are examples, not a full list, and the laws change. Look up the law in each state where affected people live; your state attorney general's website is usually the best place to start. Your lawyer should check each one for deadlines, who else must be told and what the notice must say.

Others to consider

The FTC's guide also lists:

• Law enforcement. Report the incident to your local police right away. If they aren't familiar with this kind of case, the FTC suggests contacting the FBI or U.S. Secret Service. For stolen mail, contact the U.S. Postal Inspection Service.
• Credit bureaus. If Social Security numbers were stolen, the FTC says to contact the major credit bureaus, and to tell them if you'll be recommending fraud alerts or credit freezes to many people.
• Banks and other businesses. Tell any bank or business whose account details were exposed, and any organization whose data you were holding.
• Health information. If health records were involved, the FTC's Health Breach Notification Rule or the HIPAA Breach Notification Rule may apply, with their own notice duties.

Also tell your board promptly. A breach is the kind of risk the board needs to know about, and it may need to approve spending on experts, notices or credit monitoring.

Telling the people affected

The FTC says to notify people quickly so they can protect themselves, and to coordinate the timing with law enforcement if they ask you to wait. A clear notice should:

• explain what happened and when, in plain words,
• say what information was involved,
• say what you've done to fix it and protect people,
• tell people what they can do, such as changing passwords, watching their accounts, or placing a fraud alert or credit freeze,
• point them to IdentityTheft.gov, the FTC's site for recovering from identity theft, and
• give a named contact, a phone number and an email address for questions.

The FTC suggests considering at least a year of free credit monitoring or identity theft protection when financial information or Social Security numbers were exposed.

Be honest and specific. Don't say "no information was taken" until you know that. Put answers to common questions on your website, and brief whoever answers your phone. Our crisis communications guide covers talking to donors, the press and your community.

After the first days

• Fix the cause and act on your expert's recommendations. The FTC also suggests reviewing who has access to what, and limiting it to people who need it.
• Hold a short review with the board: what happened, what it cost, and what you'll change.
• Collect less. Delete data you don't need, following your document retention policy.
• Write a one-page breach plan with names and phone numbers for your lawyer, insurer, IT help and board chair, so next time you aren't searching for them.
• Look at insurance. If you didn't have cyber cover, our insurance basics guide explains what it can pay for.

First-days checklist

• Response team named and a timeline log started
• Affected systems taken offline (not switched off) and passwords changed
• Lawyer, insurer and, if needed, a forensic expert contacted
• Evidence kept, nothing deleted
• Type of information, number of people and their states worked out
• Each state's notification law checked with a lawyer, including deadlines and agency reports
• Police contacted; credit bureaus and banks contacted if needed
• Board told
• Plain-language notice sent to affected people, with a contact and IdentityTheft.gov
• Cause fixed and lessons recorded