Immediate Steps to Take When You Suspect a Data Breach: FTC Guide (Full Transcript)

Speaker 1: A company laptop has disappeared. An employee sees unusual behavior on your network. A customer calls, fearing identity theft. You suspect a data breach. What do you do? In this video and in a written guide, the Federal Trade Commission offers steps for protecting your company, preventing additional damage, and helping your affected employees, customers, and partners reduce their risk. It's important to take action immediately, even if you don't know the cause of the breach or the full damage. It's time to secure operations, fix vulnerabilities, and notify appropriate parties. Ready? First, secure your operations. Don't let one data breach become many. Rally your response team. It may include legal, IT, finance, HR, communications, or others. You also may enlist outside forensic experts to help you investigate the cause, understand the impact, and start fixing the problem. Take affected equipment, like servers, offline right away and quickly remove any information that was improperly posted online. Secure physical areas related to the breach and consider changing employee and customer logins. Also, fix vulnerabilities. Review all the data on your system, and this goes beyond Social Security and credit card numbers. If you store any customer or employee data, your customers, employees, and your company are at risk. Do any vendors have access to your system? Ensure and verify that they're following the proper security practices. Consider changing their access privileges. Notify the appropriate parties. Call law enforcement immediately. The sooner they learn about the breach, the more effective they can be. It's important to let people know what happened and what their rights are. Under the law, you have reporting and notification responsibilities. The FTC's Data Breach Response Guide offers a model letter that can help you with these notifications. Be sure to include current guidance on recovering from identity theft and encourage those who discover that their information has been misused to visit identitytheft.gov. If you suspect a data breach, a swift, appropriate response is good for the people who have been impacted and for your business. Learn more about the immediate steps you can take, plus ways to prevent breaches and protect consumer data, at ftc.gov slash databreach.