“What would you do in the golden hour after discovering a data breach?,” asks Geoff Donson, former High-Tech Crime Unit detective and now security manager for datacentre host TelecityGroup.

“Well for me, I would definitely want to know what the data was because you are going to want to know what collateral damage you have got. Does it help you to get the data back? Probably not, but it might as the nature of the data might determine who was interested in it. You would want to know what private data was included. Was it names, was it addresses, was it bank account details?”

How you react in the first hour is also massively dependent on your preparation and planning. The best companies will already have thought about what happens in exactly this kind of scenario and will have come up with contingencies to respond immediately and seamlessly.

“The key to successfully managing any incident is to ensure you are always prepared for any eventuality by having written and tested plans. I cannot emphasise enough the value of testing. Our experience in advising clients in both the public and private sectors is that the quality of plans is significantly improved by testing them,” says Neil O’Connor, principal consultant at information security specialist Activity. “You don’t want to be testing your plans for the first time in a real crisis.”

The first 12 hours

If you are able to identify what the missing data actually is, and there is no guarantee of that as it depends on having maintained an accurate map of the data in your organisation, the next step is to try and work out who might have accessed it, someone external or internal, and work out what they might be able to do with that information.

“Some computer forensics might need to happen. Certainly you could look at the logging,” says Donson. “The logs within any Microsoft Windows system would let you see who had accessed that data last. You would probably be able to see if it had been copied in, and you would certainly be able to see if it had been printed.”

According to Dave Martin, managing security consultant at IT services company Logica, it’s also important to consider the most negative scenario and adapt your response accordingly. “At the start of the investigation of an incident, we must always assume the very worst, and that we may have to defend our actions in a court of law,” he says.