Panic is the Enemy
It's not if, but when. A pre-prepared Incident Response Plan (IRP) is critical. Who do you call? When do you notify users?
The 72-Hour Rule
GDPR mandates notification to the supervisory authority within 72 hours of becoming aware of the breach. This clock is ticking while you are debugging.
Technical Forensics Checklist
- Isolation: Take the compromised server off the network immediately to prevent further exfiltration. Do NOT turn it off (you lose RAM evidence). Just pull the network cable (or block ingress/egress rules).
- Rotation: Assume all credentials on that box are stolen. Rotate AWS keys, DB passwords, and SSH keys immediately.
- Logs: Secure your logs to an immutable storage location (S3 Object Lock) so attackers cannot wipe their tracks.
Communication Templates
Have a draft email ready. 'We are investigating an issue' is better than radio silence. Transparency is key. Tell users exactly what was taken (e.g. 'Email addresses, but NOT passwords').