If you suspect or discover a data breach, act promptly and avoid making irreversible changes before appropriate technical and insurance advice has been obtained.

If your business has Cyber Insurance, notify Webber Insurance or the insurer’s incident response service as early as possible.

1. Contain the incident #

Take reasonable steps to limit further unauthorised access or disclosure.

This may involve actions such as:

• Disabling compromised accounts
• Isolating affected devices
• Blocking malicious access
• Resetting compromised credentials

Your IT provider or incident response specialist should guide technical containment where possible.

2. Preserve evidence #

Do not unnecessarily wipe, rebuild or dispose of affected systems before speaking with the appropriate incident response specialists.

System logs, emails and other technical information may be important for investigating what occurred.

3. Notify your Cyber insurer or Webber Insurance #

Cyber policies commonly provide access to specialist response services such as:

• Forensic IT specialists
• Cyber incident response experts
• Specialist legal advisers
• Data breach specialists
• Crisis communications support

Using the insurer’s approved response providers can also be important under the policy.

4. Assess the information affected #

The response team may need to establish:

• What systems were affected
• What information was accessed or disclosed
• How many people may be affected
• Whether personal or sensitive information was involved
• Whether the incident has been contained

5. Consider notification obligations #

Australian privacy and data breach notification requirements may apply depending on the organisation and incident.

Under the Notifiable Data Breaches scheme, some organisations covered by the Privacy Act must notify affected individuals and the Office of the Australian Information Commissioner where an eligible data breach has occurred.

Not every data breach is automatically notifiable, so the circumstances should be assessed.

6. Do not communicate externally without considering the response strategy #

Before notifying customers, suppliers, regulators or the media, consider obtaining appropriate legal and incident response advice.

The timing and content of communications can be important.

You can also review our Australian data breaches list for examples of incidents affecting Australian organisations.

Contact our team promptly if you have a Cyber Insurance policy and need to report a suspected incident.