Data Breach in Your Small Business? What to Do, Step by Step
A data breach feels scary, but panic makes it worse. This guide gives a small business owner clear steps for the first hours, the first days and the weeks after, in simple language.
What should a small business do after a data breach?
After a data breach, a small business should first stop the leak by cutting off access, then save evidence, find what data was exposed, and inform the right people: your bank, staff, affected customers and authorities such as CERT-In where rules apply. Then fix the cause, change passwords and watch closely for weeks after.
Key takeaways
- Stop the leak first, then investigate.
- Do not delete logs or wipe systems in a rush.
- Find out what data was exposed and whose it was.
- Check current CERT-In rules and take legal advice early.
- Tell affected people honestly and give them clear next steps.
- Fix the root cause so it does not happen again.
What is a data breach, and how do you know you have one?
A data breach is when someone who should not have access sees, copies, changes or deletes your business data. You usually find out through an alert, a strange account activity, a customer complaint or a message from an outsider.
A breach is not always a dramatic hack. A spreadsheet of customer phone numbers shared in the wrong WhatsApp group is also a breach.
Common signs of a data breach
- Customers say they got fake calls or messages that use their order details
- Your email or website login shows sign-ins you do not recognise
- Files are missing, changed or locked with a ransom note
- Your website shows odd pages, links or redirects
If you see any of these, treat it as a possible breach. It is better to check and find nothing than to wait and lose more data.
What should you do in the first hour after a data breach?
In the first hour, stop the leak, protect money and save evidence. Do not try to find every answer yet. Your only goal is to stop the damage from growing.
- 1
Stay calm and name one person in charge
Pick one person to lead the response and keep notes. Too many people acting at once can destroy evidence or cause new problems.
- 2
Cut off the attacker's access
Disconnect affected computers from the internet or network. Do not switch them off unless an expert asks you to, as some evidence lives only in memory.
- 3
Change key passwords from a clean device
Change passwords for email, admin panels, hosting, cloud storage and banking. Sign out all other sessions and turn on two-step login.
- 4
Protect money
Call your bank if payment accounts, UPI, cards or net banking may be affected. Ask them to watch or block suspicious transactions.
- 5
Save evidence
Take screenshots of alerts, messages and strange activity. Note the date and time. Do not delete logs, emails or files yet.
- 6
Call for expert help
Contact your IT partner or a cybersecurity team. Our 24x7 emergency help is there for urgent cases.
What should you NOT do after a data breach?
Do not delete evidence, do not hide the breach from people who need to know, and do not pay a ransom or attacker without expert and legal advice. These mistakes often cause more harm than the breach itself.
Do this
- Isolate affected systems from the network
- Keep logs, emails and screenshots safe
- Use a clean device to change passwords
- Speak to experts and a lawyer early
- Tell staff only what they need, clearly
Avoid this
- Wiping or reinstalling systems right away
- Restoring an old backup before finding the cause
- Posting about it on social media in panic
- Blaming a staff member in front of others
- Contacting the attacker on your own
Many owners restore a backup straight away to make the problem go away. But if the hole that let the attacker in is still open, they come back. Our guide on what to do when a website is hacked explains why cleaning without finding the cause fails.
How do you find out what data was exposed?
Find out which systems were touched, what data they held and whose data it was. This tells you how serious the breach is and who you need to inform.
Work through each system one by one. For each, ask: was it accessed, what data was on it, and was that data copied, changed or deleted? Your expert can check logs, sign-in history and file activity to answer this.
| Type of data | Examples | Why it matters |
|---|---|---|
| Customer contact data | Names, phone numbers, emails, addresses | Used for fake calls, phishing and scams |
| Payment and bank data | Bank details, UPI IDs, card details | Direct risk of money loss |
| Identity documents | Aadhaar, PAN, passport copies | Can be misused for fraud in someone's name |
| Login details | Usernames, passwords, admin access | Lets attackers get into more systems |
| Health or student records | Patient files, student marks and contacts | Very sensitive, extra care needed |
| Business records | Invoices, GST data, price lists, contracts | Can harm your business and partners |
| Staff data | Salary details, ID copies, bank accounts | Risk to your own team |
Make a simple list: what data, how many records roughly, whose data and whether it was only viewed or also copied.
If you are not sure where your business keeps personal data, that is a sign to map it after the crisis. Our data security for small business service helps you do this.
Who do you need to inform after a data breach in India?
You may need to inform your bank, staff, affected customers or partners, and authorities such as CERT-In. Who and how fast depends on the type of incident and current rules, so take legal advice early.
CERT-In (the Indian Computer Emergency Response Team) is India's national agency for handling cyber security incidents. Its official site is cert-in.org.in. CERT-In rules ask many organisations to report certain types of cyber incidents, and the time limits can be short. Check current CERT-In rules and take legal advice so you know exactly what applies to you.
India's Digital Personal Data Protection Act, 2023 also includes duties about personal data breaches, such as informing affected people. The detailed rules can change, so check the current position with a lawyer. Our page on DPDP Act compliance basics explains the Act in simple words.
| Who | When to think about it | What to tell them |
|---|---|---|
| Your bank or payment gateway | Right away, if money or payment data may be at risk | What happened and which accounts to watch |
| Your lawyer or adviser | Within the first day | Facts so far, data affected, your timeline |
| CERT-In | As per current CERT-In rules | Incident details in the format they ask for |
| Cyber crime police | If there is fraud or money loss | Complaint with evidence |
| Affected customers | Once you know what was exposed, as advised | What data, what you are doing, what they should do |
| Staff | Early, with clear instructions | What to say, what not to say, who to send questions to |
If money was lost through online fraud, report it quickly to the National Cyber Crime Helpline 1930 or on the cybercrime.gov.in portal, and call your bank at once.
How should you tell customers about a data breach?
Tell customers honestly, simply and quickly once you know the facts, and give them clear steps to protect themselves. Silence or vague words damage trust more than the breach.
A good message answers four questions: what happened, what data of theirs was involved, what you are doing about it and what they should do now. Keep it short. Avoid technical words and guesses.
- Say what happened in plain words, without blaming anyone
- Say which type of their data was involved
- Say what you have already done to stop it
- Tell them what to do: change passwords, watch for fake calls, never share OTPs
- Warn them that you will never ask for OTP, PIN or passwords on call or WhatsApp
- Give one contact person, phone number or email for questions
- Have your lawyer check the message before it goes out
In India, a common follow-up scam is fake calls that use leaked order details to sound real. Warning customers about this is one of the most useful things you can do. Our phishing protection training helps your own staff spot the same tricks.
How do you fix the cause and recover safely?
Find out how the attacker got in, close that door, clean every affected system and only then restore from a clean backup. Recovery without a fixed cause is not recovery.
- 1
Find the entry point
Use logs and a proper check to see how the attacker got in. A security audit does this in a structured way.
- 2
Close it
Update software, remove unknown users, fix wrong sharing settings and remove old staff access.
- 3
Clean affected systems
Remove malware and backdoors. For websites, our malware removal service cleans files and the database.
- 4
Restore from a clean backup
Pick a backup from before the breach and check it is clean. Our backup and disaster recovery page explains safe restores.
- 5
Reset all access
Change every password again after cleaning, and turn on two-step login for all key accounts.
- 6
Watch closely
Monitor logins, files and traffic for some weeks. Attackers sometimes try again.
How can you stop another data breach?
Stop another breach with a few strong basics: two-step login everywhere, unique passwords, regular updates, tested backups, limited access and trained staff. A simple written response plan helps you act fast next time.
| Protection | What it stops | Effort for a small business |
|---|---|---|
| Two-step login on email, banking, admin | Logins with stolen passwords | Low |
| Password manager and a password policy | Reused and weak passwords | Low |
| Regular software and plugin updates | Known security holes | Low to medium |
| Tested backups kept off the main system | Data loss and ransomware damage | Medium |
| Staff phishing training | Fake login pages and payment scams | Medium |
| Ongoing monitoring | Slow, quiet attacks going unnoticed | Medium |
Our password security policy gives you a simple template. When people leave, use the employee offboarding security checklist so no old access stays open.
Write a one-page breach response plan
Write down who leads, who to call (IT partner, bank, lawyer), where backups are and how to reach staff. Print it and keep a copy outside your computers. In a real breach, you may not be able to open your own files.
How can SI Cyber help after a data breach?
SI Cyber helps you contain the breach, find how it happened, clean and restore systems, and set up protection so it does not happen again. We explain each step in simple language.
We work with websites, business email, cloud storage and office systems. After recovery, our security monitoring service watches for signs of a repeat attack. We do not give legal advice, but we prepare clear technical facts your lawyer can use.
SI Cyber is powered by Shivah Web Tech, with 11+ years of experience and a 25+ member in-house team. We work Monday to Friday, 9:30 to 6:30 IST, from Mohali, with 24x7 emergency support for urgent issues. Contact us and you get a clear quote after a free call.
Related Pages
Website Hacked? Steps
Calm, step-by-step actions to take in the first hours after a hack.
DPDP Act Basics
A simple guide to India's data protection law and the security steps it needs.
Backup & Recovery
Tested backups and a clear plan to get back online fast.
Security Audit
A clear report of your security gaps and how to fix them.
Frequently Asked Questions
What is the very first thing to do after a data breach?
The first thing is to stop the leak. Disconnect affected devices from the network, change key passwords from a clean device and sign out all other sessions. Then save evidence such as screenshots and logs. Do not wipe systems or restore backups yet. Call an expert who can check the systems properly before you clean anything.
Do I have to report a data breach to CERT-In?
CERT-In rules ask many organisations in India to report certain types of cyber incidents, and the time limits can be short. Whether your incident must be reported, and how fast, depends on the type of incident and the current rules. Check the current CERT-In rules on its official site and take legal advice quickly so you do not miss a deadline.
Should I tell my customers if their data was leaked?
In most cases, yes. Customers need to know so they can protect themselves from fake calls, phishing and fraud. India's DPDP Act, 2023 also includes duties to inform affected people about personal data breaches. Tell them honestly what happened, what data was involved and what they should do. Have a lawyer review the message first.
Can a small business be fined for a data breach in India?
Data protection laws in India, including the DPDP Act, 2023, allow for penalties when businesses fail to protect personal data or fail to meet their duties. The exact rules and amounts depend on the law and the facts of each case. Because this area is still developing, take legal advice rather than guessing your risk.
Should I pay a ransom if hackers stole our data?
Do not pay or contact the attacker on your own. Paying does not promise that the data will be deleted or returned, and it may mark you as an easy target. Speak to cybersecurity experts, your lawyer and the police first. Good backups and quick containment often give you options other than paying.
How long does it take to recover from a data breach?
It depends on how many systems were affected, how clean your backups are and how quickly the cause is found. A small website breach may be handled in days, while a breach across email, files and systems can take longer. Ongoing monitoring for some weeks after recovery is wise, as attackers sometimes try again.
Is a lost laptop a data breach?
It can be. If the laptop held business or customer data and was not protected by a strong password and disk encryption, treat it as a possible breach. Change passwords of accounts that were signed in on it, remotely sign it out of email and cloud services, and follow the same steps for informing people where needed.
Talk to our team today
Call or WhatsApp +91 85808 92163. We reply fast, Monday to Friday.