What is a data breach?

A data breach occurs when sensitive information becomes accessible to unauthorized individuals. This may involve customer records, employee information, authentication credentials, financial data, or intellectual property.

Common causes include compromised accounts, vulnerable web applications, misconfigured cloud storage, insider threats, and ransomware attacks.

The first hour: contain the incident

The first priority is stopping the breach from spreading. Every minute an attacker remains active increases the risk.

  • Disable compromised accounts.
  • Revoke API keys and access tokens.
  • Isolate affected systems.
  • Preserve logs and forensic evidence.
  • Enable additional monitoring.

Avoid rebuilding or wiping systems immediately, as this may destroy valuable evidence required for investigation. Coordinate containment with the incident lead so that actions reduce risk without unnecessarily destroying forensic evidence.

Investigate the attack

Identify how the compromise occurred and what assets were affected. Start with trusted log sources and preserve relevant records before retention windows expire.

# Linux authentication and service logs
last -a
journalctl -u ssh

# Cloud audit events (examples)
aws cloudtrail lookup-events
gcloud logging read 'timestamp >= "2026-10-21T00:00:00Z"' --limit=100
az monitor activity-log list

Review authentication logs, cloud audit logs, firewall events and application logs to reconstruct the attack timeline. These commands are starting points only; adapt permissions, time ranges and filters to your environment.

Determine the impact

  • Critical: passwords, secrets, encryption keys.
  • Sensitive: customer and employee records.
  • Financial: payment and billing information.
  • Operational: internal systems and business data.

Determine which data was accessed, copied, altered or made unavailable, and identify the systems, accounts, customers and time period involved. The distinction between confirmed exposure and suspected exposure should be documented clearly.

Notify stakeholders

Data breaches can trigger legal, contractual and regulatory obligations. Engage relevant stakeholders early and keep a record of decisions and the evidence supporting them.

  • Executive leadership
  • Security and incident-response teams
  • Legal and compliance teams
  • Customers and partners, where appropriate
  • Regulatory authorities when required

For incidents involving personal data in the EU, assess GDPR notification requirements promptly with your data protection officer or legal counsel. Where applicable, notification to the supervisory authority is generally required within 72 hours of becoming aware of the breach. Do not wait for the technical investigation to be fully complete before assessing your obligations.

Secure the environment

After containment and investigation, eliminate the root cause before restoring normal operations.

  • Patch exploited vulnerabilities.
  • Rotate exposed credentials, keys and tokens.
  • Enforce MFA, especially for privileged accounts.
  • Review IAM permissions and remove excessive access.
  • Remove unauthorized accounts, persistence mechanisms and scheduled tasks.
  • Harden cloud resources and validate security configurations.

Verify recovery

Before closing the incident, verify that affected systems are secure and that monitoring is in place.

# Example host checks
docker ps
ss -tulpn
  • Confirm vulnerable systems were patched or isolated.
  • Ensure compromised credentials have been revoked and replaced.
  • Validate backup integrity before restoring data.
  • Monitor for signs of persistence or renewed access.
  • Restore services in a controlled order and verify critical business functions.

Lessons learned

Every breach is an opportunity to improve security maturity. Conduct a formal review and document:

  • What failed and why.
  • What worked well during response.
  • How detection and escalation can be improved.
  • Which preventive and detective controls should be added.
  • How future incidents can be contained faster.

In short

Organizations that prepare for breaches recover faster and reduce avoidable damage. Strong monitoring, effective incident-response plans, appropriate access controls and rapid, evidence-aware containment are the foundations of a resilient security posture.

If you need help assessing your cloud security posture or building an incident-response capability, schedule a Cloud Security Posture Review and Incident-Response Readiness Audit and we will help identify risks before attackers do.