How do you find out about a data breach?
Often the company doesn't detect it itself. A third party does: a customer who receives a phishing email containing real details of their order, a researcher, a journalist, a post on a leak site or an extortion email. Where the news comes from shapes your first check.
| Origin | Example | First check |
|---|---|---|
| Exposed configuration | Public cloud storage or a database with no password | The resource's permissions and access logs |
| Attack with exfiltration | Data stolen before a ransomware attack | Outbound traffic, sync tools, accounts used |
| Supplier | Your data in a third party's systems | What you shared with them and who their security contact is |
| Insider | Someone copies information before leaving | Mass downloads, USB drives, emails sent to personal accounts |
| Human error | An email sent to the wrong recipient, or a public link | The sending record and who could have opened it |
| Compromised SaaS account | Access to the CRM or storage with stolen credentials | Recent sign-ins and exports |
How do you confirm whether the leak is real?
- Get a sample and compare it with your systems: fields, format, internal identifiers and the date of the most recent record, which tells you when the data was extracted.
- Check whether it is a compilation of old breaches. This often happens with so-called mega-leaks.
- If a ransomware group claims it, analyze the sample it publishes and compare the timeline with your own logs.
- Don't download large dumps from criminal sites onto corporate devices. Have specialists do it in an isolated environment, and check with your legal counsel before handling data published by third parties.
- Keep extortion emails as evidence and don't reply.
What should you do in the first few hours to contain the breach?
- Cut off the exit path: remove public access, revoke shared links, disable the accounts involved and block exfiltration destinations.
- Preserve evidence before changing configurations: screenshots of permissions, access logs and copies of logs that rotate, because some cloud services keep them for only a short time.
- Rotate any secret that appears in the exposed data: passwords, API tokens and cloud access credentials. Attackers test them very quickly.
- Form a team with security, IT, management, legal counsel and communications, with one person in charge.
- Start a chronological log of findings and decisions from the very first minute.
How do you investigate the scope: what data, whose, and since when?
The scope determines everything else: who to notify, what risk the affected people face and what measures you need. These are the questions you need to be able to answer:
- What types of data: identifying, contact, financial, credentials, health, internal documents or intellectual property.
- Whose data: customers, employees or suppliers, and how many unique records.
- Time window: since when it was accessible and when it was extracted.
- Whether there was actual access or only exposure.
- How it got out and whether that path is still open.
To reconstruct how the data left, cross-check several sources: cloud storage access logs, SaaS application audit logs (CRM exports or mass downloads), outbound traffic volume on the firewall or proxy and, on endpoints, the use of compression tools such as 7-Zip or WinRAR and sync tools such as Rclone right before large uploads. CISA's #StopRansomware Guide lists Rclone among the common exfiltration tools.
How do you communicate a data breach?
Before you communicate anything externally, check with your legal counsel about any obligations that may apply to you, including those in your contracts with customers and suppliers. After that, a few guidelines help you avoid common mistakes:
- A single spokesperson and the same message inside and outside the company.
- Explain what data was affected, what you are doing and what the people affected should do, such as changing their passwords.
- Warn that the data may be used for targeted phishing or invoice fraud.
- Don't speculate about the attacker or play down the incident before you know its real scope.
- Update the information as the investigation progresses.
What risks follow a data breach?
According to IBM's Cost of a Data Breach Report 2026, the global average cost of a data breach reaches $4.99 million, 12% more than the previous year. And the damage doesn't end with containment. In the months that follow, risks like these appear:
- Targeted phishing and fraud using real data, such as contact names or invoice numbers.
- Use of the leaked credentials on other services.
- Repeated extortion: the data can resurface or be resold even if a ransom was paid.
- Impersonation of your company to customers and suppliers.
How do you monitor for exposure afterward?
- Search for your data and your domains on forums, marketplaces, messaging channels and ransomware groups' leak sites.
- Set up alerts for credentials from your domains in infostealer logs and combolists.
- Watch for lookalike domains registered after the incident.
- Check whether the incident's indicators reappear on your network.
- Schedule periodic reviews over the following months, because the data may be published late.
How Ciberia helps with a data breach
Ciberia Intel gathers proprietary and third-party intelligence on the dark web, forums, credentials and infostealers, and Ciberia CTM continuously monitors your external exposure: leaked credentials, exposed infrastructure and mentions of your brand and executives, with alerts that include context and the recommended action. With Threat Hunting, Ciberia searches retrospectively for persistence and lateral movement. If the attacker is still inside, Ciberia MDR monitors the telemetry you already have 24/7, with an SLA of 15 minutes from critical alert to initial containment.
