One day a customer calls us, in a panic. Their website looks as though it has been breached, with a possible leak of customer data. We set up an emergency video call.
Around ten people connected, from different departments. Everyone is talking, questions fly, so do suggestions. Some of them contradictory. The stress is palpable.
The attacker may have needed only a few minutes. On our side, we were counting in weeks. In between sits everything that had been decided beforehand, or not.
The first hour is decided by governance
That day, the flaw was still open, and ten people were discussing what to do.
Everyone had a good reason to speak. Sales was thinking about customers, technical staff about the server, management about the CNIL, France's data protection authority. Nobody had the mandate to decide.
After a while, it had to be said plainly: “I am going to have to leave you. I need to deal with the urgent work. We will take stock afterwards.”
The priority was to limit the consequences, investigate, preserve the traces, launch the analyses and check sensitive access.
It was not rudeness. While people debate, the intrusion carries on.
A crisis unit works on two roles assigned before the incident. One person who decides, one person who speaks. Without that, ten opinions produce zero decisions.
Cut off the intruder's access without halting the business
The first useful decision is to close the door. It is rarely simple.
Changing an admin password is easy. Renewing API keys, service credentials, server access and the accounts applications use to talk to each other is far less so.
In many companies, nobody knows exactly where those credentials have been copied. A backup script, an accounting connector, a partner integration set up three years ago.
Renewing them in a hurry then breaks things, mid-crisis, at the worst possible moment.
Two questions to ask in calmer times.
- Can one compromised account reach the entire customer database?
- Do you know how to revoke and renew those credentials without interrupting service?
The first one is about what an intruder would find on your side. We covered it in a data breach can cost you your customers and your sleep. The second is something you test, like a backup.
You will only investigate the traces you kept in advance
Once the incident is contained, another question comes up. What actually happened?
Answering it requires technical logs, kept for long enough. Many installations keep them for a few days only, to save disk space.
An intrusion discovered three weeks after it started then becomes unreadable. The traces of the entry have disappeared in the automatic log rotation.
Then comes preservation. The first reflex, clean up and reinstall, destroys the evidence the complaint, the insurer and the authority will need.
The guide for business leaders published by Cybermalveillance.gouv.fr, the French government's cyber victim assistance platform, insists on this order. Preserve the evidence, set up a crisis unit, alert the insurer, file a complaint.
- Are the logs kept long enough to reconstruct several weeks?
- Do you know how to preserve the evidence before it disappears?
- Who, by name, leads the investigation and the containment?
Notifying is a decision, and it has an owner
If personal data is involved, the CNIL must be notified within 72 hours. The clock starts before you have all the answers.
In practice, that deadline is rarely lost to technical analysis. It is lost looking for who has the right to decide.
The same question applies to the people affected. Should they be told, when, and in what words?
Badly handled, a crisis makes the incident worse. A late message, a contradictory message, or a message that plays things down while the information is already circulating elsewhere.
The companies that come through best have often prepared these texts in calmer times. A notification template, a customer message, an approval chain, a single spokesperson.
That work takes half a day on a day without an incident. It is nowhere to be found on a Tuesday evening in the middle of a crisis.
- Who decides on the declaration to the CNIL, and against which criteria?
- Who assesses whether the people affected need to be informed?
- Are the message templates and the approval chain written down?
- Who runs the crisis, and who speaks, so that ten contradictory decisions do not happen?
A backup is judged by its restore
Then comes the moment to restart. Two traps sit there.
The first: a backup reachable from the compromised system has often been encrypted or wiped along with it. Isolation is not a housekeeping detail.
The second: putting yesterday's image back into service also puts yesterday's flaw back. The intruder knows the way, and takes it again.
A backup never restored is a hypothesis, not a guarantee. The restore is tested, on a fixed schedule, on a separate environment.
- When was the last full restore tested, and by whom?
- Are the backups out of reach of a compromised account?
- Do you know how to go back into service without reintroducing the original flaw?
After the flaw, trust is the slowest thing to repair
Even with the flaw fixed, the consequences continue. A name, a phone number, a purchase history are often enough for a fraudster to win a customer's trust.
With the support of AI, these attempts are personalised and automated at scale. The attacker automates, the company mobilises people.
The risk is commercial as much as technical. Customers who hesitate to order again, who move to a competitor, who tell the story around them.
The quality of your response therefore counts as much as the strength of your defences. Customers do not see your firewall. They see how you told them.
None of this removes the risk. An application connected to the internet can be attacked, and no amount of preparation changes that.
What changes is the duration. Between the company that discovers these questions in a panic and the one that already has the answers, the gap is not measured in security. It is measured in weeks.
You do not need an audit to start. Put these questions to your teams at the next meeting. The ones left unanswered will tell you where to begin.
A cyberattack is complicated enough already. There is no need to add improvisation to it.