It usually shows up on a Tuesday afternoon. An email from the company that runs your payroll, or your accounting software, or the system that holds your customer records. The subject line says something like “Important security notice.” It is a data breach letter, and it says the vendor found a security incident, has started an investigation, and will share more soon.
Then you read it twice and realize it never says whether your business was affected, what information was involved, or what you are supposed to do. That is normal. The first data breach letter usually goes out before the vendor knows the full story.
You do not have to wait for their final report to start asking questions, though. Let me walk through what to do in the first hour, the nine questions to send back, and who else needs to see the data breach letter before the week is out.
The data breach letter arrived. Here is why it says so little
When a software company finds a break-in, its security team spends days or weeks reading logs, figuring out which systems were touched, and working out whose information was in them. That takes time. But laws and contracts often require them to warn customers early.
So the first data breach letter is written to be careful. It says what they know for sure, which is not much, and promises updates. The phrases in it are chosen by lawyers. “No evidence of misuse” and “the incident has been contained” both sound reassuring, and both mean less than they sound like. I will explain each one below.
Meanwhile, you might need to reset passwords, check recent payments, warn your staff about follow-up scams, or call your insurance company. Some of that cannot wait for the investigation to finish.
First, make sure the data breach letter is real
Before you click anything, confirm the email actually came from the vendor. This sounds paranoid. It is not.
When a breach makes the news, scammers send their own fake versions within days. A fake data breach letter with a “reset your password here” button works especially well, because the breach is real and the customer is already worried. Do not use the links or phone numbers in an unexpected notice. Type the vendor’s website address yourself, sign into the customer portal the way you normally do, or call the rep you already know. The UK’s National Cyber Security Centre recommends the same approach in its guidance on spotting scam messages.
Once you know it is genuine, save the original email and any attachments. You will want them later.
9 questions to ask the vendor after a data breach letter
Send these in writing, and ask for the answers in writing. A phone call is fine for comfort. Email is what you will need when your insurer or attorney asks what you were told and when.
1. Was our business affected, or do you not know yet?
A breach at a software company does not always touch every customer. It might involve one product, one database, or one group of accounts.
The first data breach letter rarely answers this, so ask them to put your business in one of four buckets: confirmed affected, possibly affected, confirmed not affected, or still under investigation. That wording matters. “Still under investigation” does not mean you are safe. It means they have not finished checking. Ask when they expect a clearer answer, and what they suggest you do in the meantime.
2. When did it start, and when did you stop it?
The date on the data breach letter is just the date they told you. Ask when the break-in actually began, when they noticed it, and when it was shut down. A date range is fine if that is all they have.
Those dates tell your IT provider how far back to look on your end, at sign-ins, payment changes, invoices, and anything else that happened during that window.
3. What exactly of ours was involved?
“Customer information may have been affected” is too vague to act on. Ask what information connected to your business was involved. Depending on the software, that could be employee or customer contact details, payroll data, payment records, contracts, uploaded files, support tickets, usernames, or the keys that let other systems connect to it.
Two businesses can use the same software very differently. One stores names and emails. Another uploaded tax documents and bank details. Same vendor, same data breach letter, very different risk.
If they say the data was encrypted, which means scrambled so it cannot be read without a key, ask whether the keys were also reached. Encryption only helps if the attacker did not get what they needed to unscramble it.
4. Was it viewed, copied, or just sitting on a system that was reached?
This is where “no evidence of misuse” comes in. Ask what records support that statement, and whether those records cover the whole period. No evidence means they have not found any. It does not always mean they can prove nothing happened. Sometimes the logs simply were not kept long enough to tell.
5. Do any passwords, keys, or connections need to change?
Modern software talks to other software without anyone typing a password. Your vendor may be connected to your email, your accounting system, your payment processor, or your file storage through behind-the-scenes keys and connections. Ask whether any of those were reached, and exactly which ones need to be reset or replaced.
Let your IT provider handle that part. Pulling the wrong connection can stop your systems from syncing, and that is a mess of its own. And if anyone used the same password for this vendor and anything else, change it everywhere it was used.
6. What have you fixed, and what is still temporary?
When a data breach letter says “contained,” it usually means they stopped the activity they know about. The repairs may still be underway, and some early fixes are stopgaps. Ask what they did to secure things, whether an outside security firm looked at it, whether they consider the service safe to use right now, and when the permanent fixes will be done.
7. What do you need us to do, and by when?
The data breach letter itself is written for every customer at once. Ask for instructions specific to your account, in writing. That might be an update to install, accounts to reset, activity to review, or a connection to remove. If there is a deadline, get the date. Also ask whether they have seen fake follow-up emails or calls using their name, and ask for examples you can show your staff.
8. Was another company involved?
Software companies rely on other companies for hosting, payments, email and support. If the breach happened at one of those, ask who it was, what they held, and whether your vendor still uses them. You chose the vendor. They chose that company, and they should be able to explain it.
9. Who is our contact, and when is the next update?
Explaining your situation to a different support person every day gets old fast. Ask for a named contact or the incident team’s address. Ask where official updates will be posted and how often. When it is over, ask for a final report covering what happened, what was involved, how it happened, and what they changed.
For the long view on how these responses are supposed to run, NIST’s incident response guidance is thorough. You do not need to read it. Your vendor should have.
Who else needs to see the data breach letter
The vendor handles its own systems. Your business may still have its own responsibilities, and this is where people get caught.
Your cyber insurance company. This is the one I would call first, and the one most businesses forget. Many policies require you to report a possible incident within a set time, and some require you to use their approved attorneys or investigators. Read your policy or call your agent the same week the data breach letter arrives. We go over what to look for in a policy in our post on cyber insurance renewal questions.
Your attorney. If employee or customer personal information was involved, you may have your own duty to notify people. Here is what I am honestly not sure of for your business: those rules depend on your state, your industry, the type of information, and your contract with the vendor. In Texas, that is a question for your attorney, and it is worth asking early, not after the deadline has passed.
Your IT provider. To check your side for the dates the vendor gave you, rotate any keys, and watch for the follow-up scams. If you have a written plan for incidents, this is when you pull it out. If you do not, our post on incident response plan steps is a good place to start one.
Keep a folder, starting today
Make one folder for the incident. Put the original data breach letter in it, every update, your questions, their answers, what you did and when, who approved it, and what your insurer, attorney, and IT provider told you.
That sounds like busywork. It is the thing that lets everyone work from the same facts, and it is your record of how you handled it if anyone asks later.
Should you stop using the vendor?
Not automatically. Breaches happen to careful companies too. Look at what was exposed, how they handled it, and whether the cause is actually fixed.
Pay attention to how they communicate. A vendor that answers plainly and on time is telling you something good. One that dodges reasonable questions, or cannot explain how the service is safe now, is telling you something too. Next time you pick a vendor, ask these questions before you sign. Our post on vetting third-party vendors has the list, and the UK’s National Cyber Security Centre has a good set of supplier questions for contracts, including who notifies whom and how fast.
If keeping up with which vendor holds what is more than you want on your plate, that is part of our vendor management service.
Frequently asked questions
What should I do first when a data breach letter arrives? Confirm it is real by going to the vendor directly, not through the links in the email. Then save a copy, ask whether your business was affected, and call your cyber insurance company.
The vendor says there is no evidence our information was misused. Are we fine? Maybe. Ask what records support that, whether they cover the full period, and whether the investigation is finished.
Should everyone change their passwords after a data breach letter? Follow the vendor’s instructions and ask your IT provider which accounts matter. Any password used for this vendor and somewhere else should be changed everywhere.
Do we have to tell our customers about a vendor’s breach? Not always. It depends on what was involved, where the people are, your contracts, and the laws that apply. Ask your attorney before deciding.
Does a data breach letter mean we should switch vendors? Not by itself. Look at what was exposed, how they responded, and whether the problem is fixed. How they answer your questions tells you a lot.
If a data breach letter just landed and you are not sure where to start, that is exactly what our IT first aid guide is for. And if you would rather talk it through with someone, give us a call.
Featured image: Pexels
