What to Do After a Data Breach at a Small Business

The First 24 Hours

• Contain, don't clean up. Disconnect affected devices from the network (unplug the ethernet cable or disable Wi-Fi, don't power them down). Powering off can destroy forensic evidence that's needed later to determine what happened and what data was actually accessed.
• Call your IT provider or a forensic firm before your insurance carrier. Your carrier will want documentation, and your incident response team is what produces it. Most cyber insurance policies also require you to use an approved incident response vendor to remain covered, so check your policy before you start remediation work on your own.
• Preserve, don't delete. Logs, emails, and system images related to the incident should be preserved as-is. Deleting anything, even something that looks like malware, can compromise the investigation and your legal position later.
• Loop in legal counsel early. Notification obligations, what counts as 'personal information,' and how you communicate with affected individuals all carry legal weight. This isn't a step to handle informally over email with your ops team.
• Document everything as you go. When the breach was discovered, what systems were affected, what actions were taken and when. This record becomes the backbone of your regulatory notifications and, if it comes to it, your defense.

Pennsylvania's Notification Requirements

• Timing: The law requires notification 'without unreasonable delay.' There's no fixed number of days, but delay is only justified for two reasons: an active law enforcement investigation, or the time genuinely needed to determine the scope of the breach and restore system integrity.
• Attorney General notification: If the breach affects 500 or more Pennsylvania residents, the state Attorney General's office must be notified as well, not just the affected individuals.
• Credit monitoring: Under the 2024 amendment, businesses may be required to provide affected individuals with 12 months of credit monitoring, depending on the type of information exposed.
• Enforcement: BPINA violations are treated as unfair trade practices under Pennsylvania's Unfair Trade Practices and Consumer Protection Law, enforced by the Attorney General. There's no private right of action under BPINA itself, but that doesn't mean there's no legal exposure. It just means it comes through a different door.

What Not to Do

• Don't power down affected devices. It feels like the responsible move. It usually isn't.
• Don't notify customers before you know what actually happened. An inaccurate early notification can create more legal exposure than a slightly delayed accurate one.
• Don't assume a ransom payment guarantees data return or deletion. Law enforcement and most incident response firms advise against paying without exhausting other options first, and payment doesn't obligate the attacker to do anything.
• Don't handle it entirely in-house if you don't have a security team. A well-meaning internal fix can destroy the evidence needed to determine what was actually accessed, which affects both your legal notification obligations and your insurance claim.

Reducing the Odds of a Repeat