What to Do When an Employee Reports a Data Breach

November 2, 2026 - Cybersecurity & Compliance

When an employee reports a possible data breach, your first task is to take the concern seriously and pass it to the person responsible for handling incidents. You do not need to confirm that a breach occurred before escalating it. A quick, organized handoff can help your business protect information while preserving facts that may be important to the response.

This practical checklist explains what employees should report, what business owners should record, and how to avoid actions that could complicate an investigation. It is general guidance, not a substitute for advice from your IT provider or qualified legal counsel.

What an employee should do first

Employees should report a concern as soon as they notice it, using the company’s established incident-reporting channel. That might be a designated manager, an internal security contact, or the help desk. If the normal channel is unavailable, they should contact the named backup or a manager rather than waiting to investigate on their own.

Thank the employee for raising the issue. Avoid blaming them or asking them to prove that information was exposed. The report may turn out to have a harmless explanation, but the right person should make that assessment.

Ask the employee to share what they observed in their own words. Useful details include:

• What appeared unusual, and how they noticed it.
• When they first noticed the issue and whether it is still happening.
• Which device, account, application, or business system may be involved.
• What information might be affected, if they can tell.
• What actions they have already taken, such as clicking a link, replying to a message, or contacting someone.
• Whether they still have relevant messages, files, screenshots, or other records.

Employees should share only what they know. Guessing about the cause or scope can distract from the facts. They should not forward potentially sensitive information to a personal account or send it to coworkers who do not need it.

What the business should do after receiving the report

Assign an incident lead

Route the report to the person responsible for coordinating the response. Depending on the business, that may be an owner, an IT lead, a security contact, or a designated outside IT provider. If the usual contact is unavailable, use a documented backup. Make sure someone is responsible for coordinating decisions and keeping a record of what happens.

For small businesses without a formal incident team, the important thing is to know in advance who will take charge and how to reach them. A written cybersecurity checklist for business owners can help identify response contacts before an incident occurs.

Record facts and preserve relevant material

Start an incident record. Write down when the report came in, who reported it, what they observed, which systems may be involved, and what steps have been taken. Keep notes factual and distinguish confirmed observations from open questions. Update the record as new information becomes available.

Preserve relevant messages, files, alerts, and system records. Do not delete suspicious emails, clear browser history, remove files, or run cleanup tools unless the incident lead or technical responder directs you to do so. Those actions may remove information that helps establish what happened.

System logs may help responders understand activity, so avoid changing logging settings or overwriting records. CISA’s guidance on using logging on business systems explains why business systems should retain useful activity records.

Limit further exposure in a coordinated way

Containment may be needed to prevent additional access or sharing, but it should be coordinated with the person leading the response. Do not power off, unplug, wipe, or reset a device that may be involved unless the incident lead or technical responder advises you to. A rushed shutdown or cleanup can interfere with evidence collection or make it harder to understand what occurred.

Likewise, do not change passwords, disable accounts, or remove access without coordination. These steps can be appropriate in some situations, but responders need to consider which accounts and systems are affected and how to preserve records. If there is an immediate risk of more information being exposed, contact the incident lead or IT provider promptly and follow their instructions.

Keep communication focused. Do not speculate publicly, contact potentially affected people on your own, or make promises about what happened. Use the business’s established internal channels and follow direction from the response lead.

Who to contact and when

Notify the appropriate internal decision-makers and technical responders without waiting for proof that a breach occurred. Depending on the circumstances, the incident lead may need to involve:

• Your IT provider or security team: They can help assess affected accounts, devices, systems, and records, and coordinate technical containment.
• Qualified legal counsel: Counsel can help assess obligations, communications, and applicable requirements based on the information involved and the people affected.
• Your cyber insurer: Review your policy and contact the insurer through its required reporting channel. Follow any instructions about approved vendors or documentation.
• Relevant vendors or financial institutions: If a third-party service, payment process, or business account may be involved, the incident lead can identify the right contact and coordinate what to share.
• Law enforcement or other appropriate authorities: The business lead and counsel can assess whether contacting them is appropriate for the circumstances.

If the information may include customer or employee personal information, make that a priority for the incident lead and counsel to assess. Identify what types of information may be involved, where affected people live, and whether vendors or contractual commitments are relevant. If protected health information may be involved, notify the appropriate privacy or compliance contact and seek qualified guidance rather than making assumptions about requirements.

Businesses operating in Florida or Georgia should not assume one response rule fits every situation. Florida’s statute on the security of confidential personal information addresses breach notification. Georgia businesses can also consult the state’s cybersecurity resources. Ask qualified counsel to assess which requirements apply; do not rely on a general checklist to make a legal notification decision.

Prepare before someone reports a concern

A response is easier to coordinate when staff already know how to raise a concern and who receives it. Give employees a clear reporting route, name a primary incident lead and backup, and make sure the IT provider and business decision-makers can be reached through a reliable channel.

Agree in advance on how to preserve records, who can authorize containment steps, and who handles communications. Include vendors, insurance contacts, and legal counsel in the planning conversation where appropriate. A business continuity plan can also help clarify who makes decisions and how essential operations continue during a disruption.

Zevonix provides managed IT services and cybersecurity support, and can be contacted to discuss your business’s IT needs. To ask about support, get in touch with Zevonix.

Frequently asked questions

Take the next step

A calm, documented handoff helps your business respond without asking employees to investigate or make legal judgments. If your team does not have a clear incident contact and reporting process, establish one now and make sure staff know how to use it.