Something happened, and you’re not sure who you’re supposed to tell.

Four groups, and what each one needs from you

• The people who help you respond: CISA’s ransomware guide names your IT department, managed security providers, and your cyber insurance company as the stakeholders to engage.
• Law enforcement: the FTC’s breach guide says to call local police right away, and to contact the FBI or the U.S. Secret Service if the police lack experience with cases like this.
• Institutions and businesses tied to the incident: the bank that holds an affected account, and any business whose data you hold.
• The people whose information was exposed: timing and wording of these notices depend on state law, which is why counsel comes before this group.

Law enforcement: four doors, one is enough to start

CISA’s guide says to report to CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center (IC3), or your local U.S. Secret Service field office. CISA takes reports at cisa.gov/report, and the IC3 takes them at ic3.gov. The FTC’s guide adds that the sooner law enforcement learns about a theft, the more effective it can be.

If money left your account, that is a separate and more urgent call to the bank. See the page on money sent to a fraudster.

Businesses whose data you hold

The FTC’s guide says to notify any business whose data you hold or store, and to tell institutions that maintain compromised accounts, such as card or bank accounts, so they can watch for fraud. If Social Security numbers were taken, it says to contact the three credit bureaus, especially when many people are affected.

New Hampshire’s breach statute, RSA 359-C:20, separates a business that owns or licenses personal information from one that only maintains it for someone else. The second kind must notify and cooperate with the owner immediately after discovering that an unauthorized person acquired the data. The statute names the New Hampshire attorney general’s office as one place notice can go. Which part applies to you, and by when, depends on facts an attorney evaluates.

The legal questions belong to a lawyer

The FTC says every state, the District of Columbia, Puerto Rico, and the Virgin Islands has a breach notification law, and that other federal or sector-specific rules may also apply. It advises starting with your own counsel, then outside counsel with privacy and data security experience.

The FTC also recommends coordinating the timing and content of notices to individuals with law enforcement, so the investigation is not hampered, and naming a single person to release information. Ask your attorney whether any delay is allowed in your case; the New Hampshire statute allows one only when law enforcement determines notice would impede a criminal investigation.

A workable order for today

1. Pick one person to be the point of contact, and keep a written log of whom you told, when, and what you said.
2. Use the telephone for these calls. CISA recommends out-of-band communication so the attackers are not tipped off while you isolate systems.
3. Call your IT provider or IT person, then your insurer (see the page on insurance first steps; a late call can matter).
4. Report to law enforcement through one of the four doors above.
5. Call an attorney with data security experience about customers, contracts, and state notices.
6. If an account or a payment is involved, call that bank or payment company the same day.

What not to do yet

Do not send a company-wide email or a customer notice before counsel has seen it. The FTC’s guide says to explain what happened, what data was taken, and how to reach you, and an attorney can confirm those facts are known before they are written down.

Telling the right people in a sensible order keeps you from making decisions about customers and notices before you have the facts.

Related

• Cyber Insurance Claim: What to Do Before You Call Anyone
• Money Sent to a Fraudster: What to Do Today
• Keeping Evidence Before You Clean Up a Computer
• What to Write Down Before You Call for Help

Sources

• FTC: Data Breach Response, A Guide for Business
• CISA: #StopRansomware Guide
• CISA: I’ve Been Hit by Ransomware
• New Hampshire General Court: RSA 359-C:20, Notification of Security Breach Required