Data Breach Response for Small Businesses: What to Do If Customer Data Is Stolen

Picture a small clinic, an online shop or a training company. On Monday morning customers start ringing to ask about an odd email they've received in your name, with their full name and phone number in it. A bit later your IT person spots strange logins on the customer database and a huge download made in the middle of the night. That's a data breach at your business, and it happens to companies of every size, including well-run ones. Don't worry: what you do over the next three days matters far more than what has already happened, and it's very manageable if you take it in the right order.

Here's how a small business should respond to a data breach: what to do in the first hours if your customer database has been stolen or exposed, how and when to report it to the ICO, how to tell the people affected without frightening them and how to prevent it. If it all started with someone on your team typing their password into a fake page, the first steps are in employee clicked a phishing link, and if criminals have used your mailbox to get your customers to pay them, in business email compromise: what to do.

In this article

1. What a data breach is and why your business is responsible
2. The first hours: what to do if your customer database is stolen
3. Reporting the breach to the ICO within 72 hours
4. How to tell the customers affected
5. Reporting the crime and getting help
6. If payments or money are involved too
7. Warning signs that someone may have got into your data
8. How to stop it happening again
9. When to get professional help

What a data breach is and why your business is responsible

A personal data breach is any security incident that leads to personal data being lost, destroyed or changed, or seen or taken by someone who shouldn't have it. A stolen customer database is the obvious example, but so is an outsider getting into your CRM, a lost laptop that wasn't encrypted, ransomware that locks you out of your data or a spreadsheet of customer details emailed to the wrong person.

What matters is your role. If your business decides why and how that data is used, you're the controller, and that means dealing with the breach, reporting it and telling the people affected is your responsibility, even if the criminals got in through someone else's mistake. That sounds like a lot, but reporting early and honestly is exactly what the regulator expects from a business that takes it seriously.

If the breach happened at your supplier

This is very common: the data sat in your e-commerce platform, your bookkeeper's software or a CRM run by another company, and the problem was on their side. That supplier processes the data on your behalf and has to tell you without undue delay, but the business that answers to the regulator and to your customers is still yours. Ask the supplier for everything they know in writing, and don't wait for their answer before you start moving.

The first hours: what to do if your customer database is stolen

You don't need all the answers to get started. Ideally, do this together with your IT person or the company that looks after your systems:

1. Write down when you found out. The ICO is clear that the clock starts when you discover the breach, not when it actually happened. If you find out on a Friday afternoon, Monday afternoon comes round very quickly.
2. Shut off access, but don't delete anything. Change the passwords for servers, the database and admin accounts, turn on two-step verification wherever it's missing and check who has admin rights, removing any account nobody recognises. If a computer is compromised, take it off the network, but the FTC advises not to switch it off until forensic experts have looked at it, because the evidence is inside.
3. Check third-party access. Suppliers, former staff, connected apps, passwords shared by email. A lot of breaches come in through a door nobody remembered was open.
4. Keep the evidence. Access logs, alerts, any emails or messages you've received and screenshots of anything you've seen. If someone contacts you claiming to have your data, don't delete that message.
5. Work out what was taken. What data was there (names, phone numbers, addresses, ID, bank details, health information), roughly how many people are affected and whether it was encrypted. This is what you'll use to decide whether to report and who to tell.
6. If money is involved, call the bank. If card or account details may have been seen, or an odd payment has already gone out, call your bank on its official number and explain what's happened.

Reporting the breach to the ICO within 72 hours

Under UK GDPR, if a breach is likely to put people at risk, you must report it to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Put simply: if that data in the wrong hands could cause problems for your customers (fraud, identity theft, distress, something private coming out), you need to report.

To check whether that applies to you, the ICO has a free self-assessment for data breaches and a breach advice line on 0303 123 1113. If you do need to report, it's done through the ICO's online form, which takes around half an hour and can't be saved halfway, so have the facts to hand. You'll be asked what happened, when and how you found out, who is or may be affected, what you're doing about it and who the ICO should contact.

What worries businesses most is not having the full picture at 72 hours, and that's completely normal. The ICO accepts information in phases: report what you know now and send the rest without undue delay. What you shouldn't do is wait until everything is tied up and miss the deadline. If you're late, you'll need to explain why. And if you decide not to report, write down why and what you did.

If you're a US business

In the US, most businesses don't have one national deadline. Notification duties depend on the breach laws of the states where the affected people live, and on any rules for your sector. The FTC's Data Breach Response guide for business walks through securing your systems, fixing what let them in and notifying the right people, and getting legal advice early helps you meet each state's timing.

How to tell the customers affected

If the breach is likely to result in a high risk to people (for example because ID documents, bank details, passwords or health data were taken), you must tell them as well, without undue delay. The ICO's small business guide puts it in a very human way: put yourself in your customers' shoes and ask whether you'd be worried.

Write the message the way you'd explain it to a customer across the counter: what happened, what data of theirs was involved, what you're doing and what they can do to protect themselves. And here's a tip that's worth a lot: warn them that over the next few days they may get emails, texts or calls pretending to be from your business, using their real details to sound convincing, and tell them how you'll contact them and what you'll never ask for. If anyone ends up with accounts or loans opened in their name, they can follow the steps in identity theft: what to do.

A clear, timely message almost always protects your customers' trust far better than silence.

Reporting the crime and getting help

Breaking into a company's systems and taking its data is a crime. In the UK you can report it to Report Fraud, the police service for fraud and cyber crime, and in the US to the FBI's IC3. Have your timeline, the logs you've kept and any messages from the criminals ready. We go through the process in how to report a scam.

If someone gets in touch saying they have your database and will publish it unless you pay, don't reply on your own and don't pay blindly. Keep the message exactly as it is, include it in your report and get advice before taking any step.

If payments or money are involved too

Sometimes a breach comes with money attached: criminals use the data to send fake invoices to your customers, change bank details or run up card charges. If money has left your business, or a customer has paid an account that isn't yours, call the bank as soon as you can so it contacts the bank that received the money. If it's still sitting in the receiving account, it can be frozen, and in many cases it comes back, especially when you act in the first hours. If your business paid an invoice with changed bank details, we explain that case in invoice fraud: what to do.

Imagine a small online shop that finds out on a Thursday that someone has downloaded its customer list using the password of a former employee nobody had removed. If that same day they change the access, keep the logs, report to the ICO on Friday with what they know and send customers a clear message saying they'll never ask for payment by text, then when the fake messages start on Monday, most customers already know to ignore them. And if one of them does pay, telling their bank that morning gives a very good chance of getting the money back.

Warning signs that someone may have got into your data

Many businesses find out late, and rarely through a big alarm. It's usually small things that don't add up:

• Customers getting fake messages in your name that include their real details, or asking whether you've changed bank account.
• Odd entries in your logs, at strange hours or from countries you don't deal with, and large downloads or exports nobody asked for.
• New admin accounts or changed permissions nobody remembers touching.
• Someone contacting you saying they have your data, or a sample of your database turning up online.
• A supplier telling you about an incident on their platform, even if they say it doesn't affect you.

If you notice any of these, start noting the times and look into it straight away. It may be nothing, but if it isn't, you'll have gained precious time.

How to stop it happening again

To prevent it, don't let a single password open the door to every customer's data. Turn on two-step verification for email, your CRM, your online shop and anything else holding customer details, and don't reuse passwords between services. When someone leaves, remove their access that same day, including the tools they only used now and then.

Think about who can see what, too. Not everyone needs to be able to download the whole database: giving each person access only to what they need for their job massively limits the damage if someone falls for a trick. And only keep the data you really need, because what you don't hold can't leak.

With suppliers, ask how they protect your data before you hand it over, and put in the contract that they'll tell you straight away if they have an incident. Keep backups that aren't connected to the network and test now and then that you can actually restore them. The NCSC's small organisations guide covers these basics in plain English. And show your team real examples of how scams arrive, because most breaches start with someone clicking a link or opening an attachment. We explain what to do in that case in employee clicked a phishing link.

Finally, have a short plan ready for the day it happens: who gets called first, who deals with the ICO and who talks to customers. One page like that will save you hours when you need them most.

When to get professional help

If you don't know how they got in or what they took, if sensitive data like ID, bank details or health information was involved, if someone is threatening to publish the data or if money has already moved, it's worth getting a professional view as soon as possible. A digital forensics expert can preserve the logs and devices so nobody can later argue they were tampered with, and find out how the attackers got in and what they took. We explain what that work involves in crypto scam lawyer or blockchain forensics expert. A lawyer can help you with the regulator, with telling customers, with the police report and with the bank.

We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is always handled by a lawyer or an expert investigator. Send us whatever you have, even if it's messy: when you found out, which system was affected, what data was there and any message you've been sent. We review it for free and tell you what to do today and what comes next. If payments were made, in many cases the money is recovered, especially when you act fast. At Kironic we do everything we can to recover your money.

One last warning: after a breach, so-called "experts" sometimes appear promising to get your data or your money back 100% in exchange for an upfront fee. That's usually a second scam. We explain how to spot them in crypto recovery scams.