Information checked: 21 July 2026.
After a breach, the priority is to contain harm, preserve evidence and restore trustworthy operation. Rushing to delete suspicious files can destroy clues while leaving the stolen credentials or vulnerable component unchanged.
In brief: Contain, preserve evidence, assess data risk and restore from a trusted state.
First actions
- Open an incident log and record when the problem was discovered.
- Decide whether to isolate the website, disable a feature or place a controlled status page.
- Preserve relevant logs, files, alerts and supplier messages.
- Use a known-clean device to protect critical email, domain, hosting and administrator accounts.
- Contact the hosting provider, maintainer and incident lead through verified details.
Assess business and data impact
| Area | Question |
|---|---|
| Access | Which accounts or keys may have been used? |
| Data | Was personal, payment or confidential data accessed, changed or lost? |
| Integrity | Were pages, redirects, downloads or emails altered? |
| Availability | Which customer journeys are unavailable? |
| Scope | Could the same credentials affect email, cloud storage or other sites? |
Notification and recovery
If personal data may be involved, assess the risk promptly. Notifiable personal data breaches must be reported to the ICO without undue delay and, where feasible, within 72 hours of awareness; record the decision even when the threshold is not met.
- Close the entry point before returning to normal service.
- Restore only from a version believed to pre-date the compromise.
- Rotate passwords, API keys, sessions and recovery methods.
- Verify the site externally and monitor for recurrence.
- Provide accurate customer communication without unsupported claims.
Acceptance check
Close the incident only after the cause, affected assets, recovery evidence, notification decisions and preventive actions are documented and owned.
Decisions during the first hours
The business may need to choose between keeping a limited service online and preserving evidence. That decision should be led by risk, not embarrassment or traffic loss. Record who authorised containment, which data may be affected and why notification was or was not required.
Records to keep
- Incident timeline and decision log.
- Copies of relevant logs and alerts.
- Credential and key-rotation record.
- ICO and individual-notification assessment.
Owner test: Reconstruct the first 72 hours from the incident record and confirm that another reviewer can understand every major decision.
Sources and date checked
This practical guidance was checked against the following primary sources. Legal duties depend on the organisation and service, so obtain qualified advice where the consequences are significant. Date checked: 21 July 2026.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.