# Data Breach Runbook

Owner: Security incident commander
Severity: SEV1 for confirmed unauthorized access to PII, financial data, card data, secrets or audit data.

## Triggers

- unauthorized database, object storage, log sink or admin access
- secret exposure in code, logs, CI/CD, screenshots or provider payloads
- suspicious admin impersonation, export or DSAR activity
- external vulnerability report with evidence of data access

## First 15 Minutes

1. Preserve evidence and restrict access to the suspected system.
2. Rotate exposed credentials or keys only after evidence capture unless active abuse is ongoing.
3. Disable affected sessions, integrations or admin scopes.
4. Start an incident timeline with request IDs, trace IDs, admin IDs, IPs and affected data classes.
5. Notify legal, DPO/privacy owner, security, engineering and executive incident owner.

## Containment

- Block attacker path at WAF, IAM, network or app control.
- Verify logs are redacted and stop unsafe exports.
- Snapshot affected data stores if required by forensic process.
- Use least-privilege emergency access with audit trail.

## Assessment

- Identify data subjects, data classes, jurisdictions and time window.
- Determine whether card data, secrets or regulated financial data were exposed.
- Verify whether data was viewed, copied, modified or deleted.

## Notification

Use `docs/runbooks/major-incident-notification.md` for regulator, provider and customer notification decisioning. Draft customer messaging must be approved by legal, privacy and security.

## Recovery

- Complete credential rotation and access review.
- Patch root cause and add regression controls.
- Attach forensic notes, legal decisions, notifications and remediation evidence.