Data Breach Response for a Small Business: The FTC's Steps to Secure, Fix and Notify
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A summary of the Federal Trade Commission's "Data Breach Response: A Guide for Business" (linked below), checked October 29, 2026, with links to the FTC's IdentityTheft.gov recovery pages it recommends. This is general information, not legal advice; state breach laws differ and a lawyer can tell you what applies to you.
Maybe a laptop with client files was stolen, an employee emailed a spreadsheet of customer data to the wrong person, or a hacker got into your invoicing system. The FTC's data breach guide for business is written for exactly this moment. It's aimed at businesses of all sizes; below is the version a small business can act on.
Step 1: Secure your operations
The FTC's first message is speed: "The only thing worse than a data breach is multiple data breaches."
- Lock down physical areas related to the breach and change access codes if needed.
- Pull together help. The FTC lists the kinds of expertise a response can involve: forensics, legal, IT and security, operations, HR and communications. A small business may have only some of these in-house; the guide suggests considering independent forensic investigators and talking to legal counsel, possibly one with privacy and data security experience.
- Stop more data loss. Take affected equipment offline right away, but don't turn machines off until forensic experts arrive. Watch entry and exit points.
- Change credentials. Update passwords for authorized users. If a hacker stole credentials, the FTC warns, your system stays vulnerable until they're changed, even after the hacker's tools are removed. Our passwords and MFA guide covers stronger sign-in.
- Take exposed data off the web. If personal information was posted on your website by mistake, remove it right away. Search engines may keep cached copies, so contact them; and search for copies on other sites and ask those sites to remove them.
- Interview the people who found it, document your investigation, and don't destroy evidence.
Step 2: Fix the vulnerabilities
- Service providers. If a vendor was involved, review what personal information it can reach, change its access if needed, and verify that it really fixed the problem.
- Network segmentation. Check whether your network separation kept the breach contained, and change it if not.
- Work with your forensic team. Find out whether protections such as encryption were on at the time, review logs to see who had access, remove access people don't need, and confirm what data was taken, how many people were affected, and whether you can contact them. Our disk encryption guide explains turning it on for laptops.
Step 3: Plan your communications
The FTC asks for a plan that reaches everyone affected: employees, customers, investors, partners. Its rules of thumb:
- Don't make misleading statements about the breach.
- Don't withhold key details that would help people protect themselves.
- Don't share information publicly that could put people at more risk.
- Post the likely questions and plain-language answers on your website.
Step 4: Notify the right people
Know your legal duties. The FTC notes that every state, plus D.C., Puerto Rico and the Virgin Islands, has a law requiring notice of breaches involving personal information. Other federal or state rules may apply depending on the data.
Law enforcement. Call your local police right away and explain the identity theft risk. If they aren't set up for this, contact the local FBI or U.S. Secret Service office. For mail theft, contact the U.S. Postal Inspection Service.
Health information. If electronic health records were involved, check whether the FTC's Health Breach Notification Rule or the HIPAA breach rule applies; each can require notifying a federal agency and sometimes the media.
Other businesses. If stolen data includes card or bank account numbers you don't manage, tell the institution that does. If you hold data on behalf of another business, tell it.
Credit bureaus. If Social Security numbers were stolen, contact the major credit bureaus, especially if you'll be advising a large group of people to get fraud alerts or freezes.
Affected people. The FTC says quick notice lets people limit the damage. It recommends you:
- Coordinate timing with your law enforcement contact so you don't hurt the investigation.
- Name one point person to release information.
- Consider letters, a web page and a toll-free number.
- Consider offering at least a year of free credit monitoring or identity theft support, particularly if financial data or Social Security numbers were exposed.
What to put in the notice
Unless your state law says otherwise, the FTC suggests a notice that clearly covers:
- What happened, when, and how the information has been misused (if known)
- What information was involved
- What you're doing about it, including any services you're offering
- What people can do: for stolen SSNs, a free fraud alert or credit freeze (our credit freeze guide explains both), and a link to IdentityTheft.gov/databreach for steps by data type
- How to reach you, and how you will and won't contact people later
That last point matters more than it looks. Breach news attracts scammers who pose as the breached company. If you say "we will only contact you by mail and will never call about this," customers can spot an impostor. See business email compromise and phishing.
The FTC guide includes a model notice letter for stolen Social Security numbers you can adapt.
Before it happens
The cheapest response is the one you never need. Keep less personal data, keep it for less time (see our records retention guide), encrypt laptops, and wipe old devices before recycling.