Company data breach — first steps if you suspect a break-in
The first few minutes after you suspect a data breach matter more than what happens afterward. Here's what to do — and what not to do — before IT takes over.
What to do in the first few minutes
Don't delete or change anything in a panic
The instinct is to quickly delete a suspicious message or file, but that can erase the evidence needed to work out what actually happened. Leave everything as it is and report it.
Write down what you noticed and when
The time something caught your attention, the exact wording of a suspicious message, or the name of an account behaving strangely — details like these, written down right away, are much harder to reconstruct later from memory.
Change the password on the affected account from a different device
If you suspect an account has been compromised, change its password from a phone or computer you're sure is safe — not from the same device that may be the source of the problem.
Notify IT and your manager immediately — don't wait to be sure
You don't need to be a hundred percent certain that a break-in happened to report it. Reporting early, even if it turns out to be a false alarm, is always a better call than waiting to confirm it on your own.
Why time matters more than anything else here
The sooner the issue reaches the right people, the more response options are still available — blocking access, notifying clients, or limiting damage are all far more effective in the first hours than after days of delay.
When it's a job for IT
- You suspect login details for a company system may have leaked
- You noticed a login to an account from an unfamiliar location or at an unusual time
- Someone told you they received a strange message that appeared to be from you or the company
- You're not sure whether what you're seeing is a real incident, but would rather report it out of caution
Think there's been a data breach at your company?
Report it immediately — it goes straight into our ticketing system, and our AI assistant assesses priority right away.