Data Breach Damage Control: The Mistakes That Make It Worse
It starts with an unusual login alert at 9am, or a staff member who cannot access a file they were in yesterday. Something feels off. By the time you confirm there has been a breach, the clock is already running - and the decisions your practice makes in the next few hours will shape how much damage actually occurs.
Most breaches do not destroy a business on their own. What causes lasting harm is how they are handled. A slow response, poor communication, or a missed notification to the right authority can turn a containable incident into something that follows your practice for years. Under the NZ Privacy Act 2020, you are required to notify the Office of the Privacy Commissioner and affected individuals if a breach is likely to cause serious harm. That obligation does not wait for you to feel ready.
The first failure point is delay. Every hour between detecting a breach and containing it is an hour the exposure can grow. Isolating the affected systems, disabling compromised accounts, and getting an IT engineer onto the problem are not things to schedule for tomorrow. They need to happen now. At the same time, someone needs to be making decisions about who to notify and what to say - not drafting a carefully worded statement three days later. If you are unsure what those first steps look like, the actions to take after a confirmed breach are worth knowing before the moment arrives.
The second failure point is communication that confuses more than it reassures. Clients and staff do not need a technical debrief. They need to know what happened, what information was involved, and what they should do right now to protect themselves. Plain language, sent promptly, through a channel people actually check, does more for trust than a polished statement that arrives a week late. Silence in the meantime gets interpreted as incompetence or cover-up, even when neither is true.
The third failure point is forgetting the people involved. If staff data was exposed, they deserve the same prompt communication and support you would give a client. If clients are anxious, a response that treats their concern as a box-ticking exercise will be remembered. Practices that handle breaches well tend to come out with their reputation intact - not because nothing went wrong, but because they responded like people who actually cared about fixing it. It is also worth knowing that the consequences of a data breach extend well beyond the initial incident, and the recovery period requires its own attention.
What good looks like in practice is a response plan that already exists before anything happens. Your IT support provider should be able to contain the breach, assess the scope, and help you understand what was accessed and how. If your practice does not yet have that kind of managed IT support in place for incidents like this, that is the gap worth closing first. You should know in advance who in your practice calls the Office of the Privacy Commissioner, who talks to clients, and who documents everything for the record. That documentation matters - it demonstrates compliance and protects you if questions are asked later. CERT NZ at cert.govt.nz also provides guidance on reporting cyber incidents and is worth having bookmarked before you need it.
After the immediate response, a proper post-incident review is not optional. What went wrong, how someone got in, and what changes will prevent a recurrence - these questions need real answers, not reassurances. Staff training on recognising phishing and handling sensitive information is part of that. So is making sure your systems are configured to reduce the risk in the first place. Cyber security for professional services businesses is less about any single tool and more about having the right foundations in place before an incident tests them.
If you are not sure whether your practice has a response plan, or whether your current IT support would know what to do in the first hour of a breach, that is worth finding out before you need the answer. ITstuffed works with professional services practices across Canterbury on exactly this. A 15-minute IT Fit Check is a good place to start.