How to Respond to a Data Breach: The FTC Playbook Businesses Need in 2026
A breach can start as a technical incident and turn into a legal, financial and reputational problem within hours. Security teams contain the intrusion while legal counsel scrambles to figure out who needs to know, and answering the second question has gotten far more complicated by 2026. State laws, HIPAA, the FTC’s Health Breach Notification Rule, the FTC Safeguards Rule and SEC disclosure rules can all apply to a single event, each running on a separate clock. The Federal Trade Commission’s guidance still gives businesses a workable sequence: secure operations, fix vulnerabilities, notify appropriate parties. In 2026, executing the sequence well means running it alongside a legal map most companies never draw until they need one.
Contain the breach without destroying the evidence
The first hours determine how much evidence survives to explain what happened. Name an incident leader immediately and pull together security, IT, legal and communications before anyone starts remediation. Add human resources when employee records or an insider are involved, bring in investor relations and securities counsel if the company is public, and loop in a privacy or healthcare compliance specialist when regulated data sits inside the affected systems.
The FTC warns against one move companies make under pressure: powering down a compromised machine before anyone preserves evidence. A rebooted or wiped system can destroy the logs, memory artifacts and timestamps investigators need to trace how attackers got in. Isolate affected systems where possible, restrict compromised credentials and remote-access sessions, and bring in independent forensic specialists when the incident exceeds internal capability. Document every major decision as it happens, including who made the call and when.
Establish what happened and what data is at risk
Once the bleeding stops, the investigation has to answer specific questions before anyone drafts a notice: how did the attacker get in, when did unauthorized activity start, when did the company discover it, and which systems held affected data. Forensic teams also need to determine whether information was viewed, copied or altered, whether it was encrypted, and whether the encryption keys themselves were exposed. A compromised key can erase the legal protection encryption would normally provide.
Speed matters, but a notice built on guesses invites corrections, confusion and fresh legal exposure. Companies do not need certainty to move. They need a defensible, documented account of who was affected and how, built quickly enough to meet whichever deadlines apply. Even so, a forensic investigation does not excuse missing a statutory deadline.
Fix the route attackers used, not just the visible damage
A patch on the first server attackers touched rarely closes the whole gap. Security teams should test for the same weakness elsewhere, revoke and rotate any credentials or tokens exposed in the incident, and confirm network segmentation worked as designed. Vendor access deserves the same scrutiny: check whether outside providers still need the access they hold, and verify they closed the vulnerability on their side.
Verizon’s 2026 Data Breach Investigations Report, which analyzed more than 22,000 breaches, found vulnerability exploitation was the leading way attackers got in: the initial vector in 31% of incidents. Remediation has not kept pace: only 26% of critical vulnerabilities in the report’s remediation data were fully patched during 2025, and the median time to full resolution rose to 43 days. A similar gap left open elsewhere just resets the clock on the next incident.
Once the fix is in place, build a communications plan covering employees, customers, partners and investors so people hear the news from the company first, not from a headline.
Build the notification matrix before the clocks expire
Notification is the part of the FTC’s framework which has aged least gracefully, not because the advice is wrong, but because it no longer covers the whole field. A single breach can trigger obligations under state law, HIPAA, the FTC’s Health Breach Notification Rule, the FTC Safeguards Rule and SEC disclosure rules at once, and each regime sets a separate trigger, deadline and recipient.
Every state, plus the District of Columbia, Guam, Puerto Rico and the U.S. Virgin Islands, has a breach-notification law covering private-sector breaches of personal information, according to the National Conference of State Legislatures. Definitions of personal information, reportability thresholds, encryption exemptions and notice deadlines all differ by state, so companies with customers in multiple states need to check the statute in each one rather than assume a single deadline covers everybody.
Federal rules add more clocks. HIPAA covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery, with separate timing for HHS depending on how many people were affected. The FTC’s Health Breach Notification Rule, amended in 2024 to cover many health apps and consumer health technologies outside HIPAA, follows a similar 60-day outer limit for breaches affecting 500 or more people, with FTC notice due alongside individual notice. Financial institutions covered by the FTC Safeguards Rule must notify the FTC within 30 days of discovering certain events affecting 500 or more consumers, a requirement in effect since May 2024. Public companies face a different clock: the SEC generally requires disclosure on Form 8-K within four business days of determining a cybersecurity incident is material, and the materiality determination itself has to happen without unreasonable delay.
One rule worth watching rather than following yet: CISA’s Cyber Incident Reporting for Critical Infrastructure Act is still working through final rulemaking as of August 2026. Once implemented, it will require covered critical-infrastructure entities to report incidents within 72 hours and ransom payments within 24 hours, but no company has an active CIRCIA reporting deadline today.
None of this replaces legal advice. State and sector rules differ enough for qualified counsel to confirm which ones apply to a given company.
| Regime | Who it can apply to | Core 2026 timing point |
| State breach-notification laws | Businesses holding personal information of state residents | Trigger, deadline and content vary by state |
| HIPAA Breach Notification Rule | HIPAA covered entities and business associates | Individual notice generally within 60 days; HHS timing depends on breach size |
| FTC Health Breach Notification Rule | Non-HIPAA health-record vendors and related apps | FTC and individual notice due together, no later than 60 days, for breaches of 500 or more people |
| FTC Safeguards Rule | Covered financial institutions | FTC notice no later than 30 days after discovery, for events affecting 500 or more consumers |
| SEC Item 1.05 | Public companies | Form 8-K generally within four business days of a materiality determination |
| CIRCIA | Future covered critical-infrastructure entities | Planned 72-hour incident and 24-hour ransom-payment reporting; not active as of August 2026 |
Write a breach notice people can use
The FTC’s model notice answers five questions in plain language: what happened, what information was involved, what the company is doing about it, what the affected person can do, and how to reach the company with questions. Good notices separate confirmed facts from what remains under investigation, and pair each type of exposure with a specific, relevant response.
A Social Security number calls for guidance on credit freezes and fraud alerts. Exposed payment-card numbers point people toward their card issuer and account monitoring. Compromised login credentials mean a password reset and revoked sessions. Exposed health information can trigger separate, sector-specific notification duties on top of the general consumer notice.
The FTC also warns companies against misleading statements, withholding information consumers need to protect themselves, or publishing technical detail which creates new risk. One detail worth adding: breach notices themselves get spoofed by phishing campaigns within days of a real incident, so make the official notice page easy to verify and spell out what the company will and will not ask consumers to provide.
Give affected people protections matching the exposed data
Credit freezes are free for anyone, not only confirmed breach victims, and they last until the consumer lifts them. To place one, contact each of the three nationwide credit bureaus separately: Equifax, Experian and TransUnion. An initial fraud alert is also free, lasts one year and can be renewed; contacting a single bureau is enough, since the bureau contacted has to notify the other two. Identity-theft victims who file a report can qualify for an extended fraud alert lasting seven years.
AnnualCreditReport.com now offers a free credit report from each bureau every week, well beyond the old once-a-year allowance many notices still cite. IdentityTheft.gov builds a recovery plan, generates the FTC report law enforcement will want, and prefills the letters recovery requires. Credit monitoring flags changes after the fact; a freeze is what makes opening a new account harder.
Treat third-party breaches as your incident too
Third-party involvement reached 48% of breaches in Verizon’s 2026 dataset, up 60% from the year before, and a vendor’s investigation does not satisfy a company’s legal duties. Companies need to determine who owns the affected consumer relationship, review the contract’s incident-notification clauses, and decide up front who sends the notices to individuals and regulators.
Require the vendor to preserve forensic evidence rather than clean up its environment first. Identify every downstream processor touching the same data, revalidate any credentials or access the vendor used inside the company’s systems, and assess whether the compromise opened a path into other parts of the business. Vendor contracts negotiated before an incident, covering security requirements, breach notice, cooperation and who pays response costs, save weeks of argument once one happens.
Turn the incident into a control change
The FTC’s December 2024 order against Marriott and Starwood is a useful reminder of what regulators scrutinize. The case followed three breaches affecting more than 344 million customers worldwide, and the resulting order required a full information-security program, tighter data-retention controls, a process for U.S. customers to request deletion of their personal information, and limits on how the company can describe its security practices to consumers.
Regulators do not stop at whether an attacker succeeded. They also weigh the security program a company ran, the data it kept, and the promises it made to customers about security. A breach response limited to patching one server misses the broader review coming next.
The FTC’s three-step sequence, secure operations, fix vulnerabilities, notify appropriate parties, still works as an operational skeleton. What has changed is everything wrapped around it: state statutes, HIPAA, two FTC rules, SEC disclosure duties and a CIRCIA rule still being finalized. Companies with an incident leader, forensic partner, counsel and notification decision tree already in place move through a breach in days. Companies building the plan mid-incident spend the same days arguing about who is in charge. CIRCIA’s 72-hour clock is not running yet, but it is worth building toward before it does.
