What to Do in the First 24 Hours After a Data Breach: A Practical Checklist for Indian Businesses

The first 24 hours after a data breach decide how much damage it does. Teams that act quickly and calmly can stop the leak, protect evidence, and meet their statutory legal deadlines. Teams that panic often make it worse: they wipe systems that held the clues, discuss the incident on channels the attacker can still read, or tell clients too late.

This guide gives Indian businesses, chartered accountancy (CA) firms, and law firms a clear, hour-by-hour plan for the first day. It covers what to do, who to tell, which reporting deadlines apply in India, and how to keep your response team's own communication private while you work.

About Lupyd: Lupyd is an end-to-end encrypted team workspace made in India. Teams use it for private channels, direct messages, secure file sharing, and voice and video calls, where only the people in the conversation can read what is shared. Later in this guide, we show how Lupyd helps you coordinate incident response safely and prevent future breaches.

The Clock in India: Two Deadlines You Must Know

In India, the first reporting deadline can arrive just six hours after you notice an incident. Two sets of regulatory frameworks matter most for Indian businesses:

Rule / Regulation	Who Must Report	Statutory Deadline	Authority / Recipient
CERT-In Directions, 2022	Service providers, intermediaries, data centres, body corporates, and government bodies	Within 6 hours of noticing the incident	CERT-In (incident@cert-in.org.in or toll-free 1800-11-4949)
DPDP Rules, 2025 (Rule 7)	Any Data Fiduciary whose personal data is breached	Initial notice without delay; detailed report within 72 hours	Data Protection Board of India and every affected data principal (person)

The CERT-In list of reportable incidents is broad. It covers data breaches and leaks, unauthorized access to systems or accounts, ransomware and other malware, and attacks on servers and cloud services. You are not expected to know the full impact or forensic root cause within six hours; you only need to raise the flag, establish your reporting baseline, and follow up as your investigation progresses.

Disclaimer: This article provides general information, not legal advice. Confirm which obligations apply to your organization, along with applicable commencement dates and sector-specific directions (such as RBI, SEBI, or IRDAI mandates), with your qualified legal advisor.

Incident Response Timeline · 24-Hour Cycle

IST Timezone Baseline

HOUR 0–1 PHASE 01

Contain

Isolate endpoints from networks without powering off. Revoke tokens and move to an out-of-band encrypted war room.

• Preserve volatile RAM & logs

HOURS 1–6 PHASE 02

Report & Preserve

Assemble the incident squad, assign defined roles, start a timestamped log, and submit the initial CERT-In report.

• 6-Hour statutory CERT-In window

HOURS 6–12 PHASE 03

Assess & Trace

Determine entry point, audit affected client/employee databases, verify third-party vendor links, and engage forensic experts.

• Root cause & blast radius

HOURS 12–24 PHASE 04

Notify & Protect

Inform the Data Protection Board, notify affected clients in clear language, brief staff, and alert insurers and banks.

• 72-Hour DPDP full dossier path

Hour 0–1: Confirm and Contain

Your immediate objective during the initial 60 minutes is to halt data exfiltration and contain adversary movement without destroying the digital forensics evidence your legal advisors and CERT-In investigators will need later.

01.

Note the Exact Timestamp of Discovery

Every statutory deadline counts down from the moment your firm notices the incident. Record the exact minute, who identified the anomaly, and the method of detection (e.g., an automated alert, employee escalation, client tip, or suspicious network egress spike).

02.

Confirm It Is a Genuine Incident

Verify that you are dealing with an active security incident rather than an innocuous IT misconfiguration. Look for indicators of compromise (IOCs): impossible travel logins, mass file renames or encryption extensions, extortion or ransom notes, deactivated antivirus guards, or confidential client records appearing outside authorized systems.

03.

Isolate Compromised Systems Without Powering Off

Sever network connectivity immediately by pulling Ethernet cables, disconnecting Wi-Fi, or isolating cloud virtual machine (VM) network interfaces. Do not shut down, reboot, or wipe the machine. Volatile RAM contains active decryption keys, malicious process memory, injected payloads, and terminal histories that vanish forever upon reboot.

04.

Lock Compromised Accounts & Invalidate Active Sessions

Reset passwords, revoke active OAuth refresh tokens, and terminate all active sessions across Google Workspace, Microsoft 365, VPNs, cloud drives, and internal practice databases for any suspicious identity.

05.

Cease Using Compromised Communication Channels Immediately

If an attacker has breached your corporate email, Slack, Microsoft Teams, or WhatsApp business accounts, assume they can read all incoming and outgoing messages. Never coordinate incident containment, share forensic captures, or discuss remediation strategies over standard in-band tools. Transition immediately to an out-of-band, end-to-end encrypted channel.

Hour 1–6: Assemble the Team and Report to CERT-In

Once emergency containment is established, focus on mobilizing your core incident response personnel and fulfilling your primary statutory obligation under the CERT-In Directions.

01.

Open a Secure, Out-of-Band Response Channel

Establish a dedicated, end-to-end encrypted incident war room completely separate from your day-to-day IT stack. Use a zero-knowledge communication workspace such as Lupyd where group messages are shielded with Messaging Layer Security (MLS) and attachments are encrypted client-side with AES before transmission. Restrict membership strictly to essential response personnel.

02.

Assign Clear Roles & Decision-Making Authority

Avoid chaotic, leaderless triage. Name four distinct functional owners:

Incident Commander / Lead: Holds ultimate decision authority on operational priorities and shutdowns.
Technical & Forensics Owner: Directs system isolation, network packet captures, log extraction, and endpoint triage.
Legal & Compliance Lead: Directs regulatory notices (CERT-In, DPDP Board) and manages statutory disclosure liabilities.
Communications Lead: Drafts internal employee briefings, client advisories, and external PR statements.

Note for small CA or law firms: While one partner may fulfill multiple responsibilities, each domain must have an explicit named individual.

03.

Engage External Specialists & Cyber Insurers

If internal capabilities are limited, contact your retained IT managed service provider (MSP), a specialized incident response forensics retainer, and outside privacy counsel. Contact your cyber insurance provider immediately; many policies require notification within 12–24 hours as a condition of policy coverage for forensics, ransom negotiation, and legal representation.

04.

File the Mandatory Initial CERT-In Report

Under the 2022 Directions, covered entities must file an incident notice with CERT-In within 6 hours of noticing the breach. Submit the initial report via email to incident@cert-in.org.in or telephone 1800-11-4949. Provide the basic facts known at the time: timestamp of detection, affected asset categories, preliminary incident classification, and containment actions taken. Clarify that forensic analysis is active and supplementary details will follow.

05.

Maintain a Chronological, Timestamped Incident Log

Document every decision, observation, system change, credential revocation, and communication with external parties in a real-time running log. This timeline will prove critical when filing the comprehensive 72-hour DPDP report, supporting cyber insurance claims, and presenting evidence during statutory investigations.

Hour 6–24: Investigate, Preserve Evidence & Prepare Notifications

With preliminary containment enforced and CERT-In notified, hours 6 through 24 shift toward deep forensics, establishing data exposure scope, safeguarding the chain of custody, and preparing stakeholder communications.

01.

Identify & Remediate the Initial Entry Point

Determine how the adversary established an initial foothold. Was it a spear-phishing credential theft, an unpatched vulnerability on an exposed server, an unauthorized shadow SaaS plugin, a stolen VPN cookie, or a compromised third-party vendor? Close this specific vector immediately to prevent the attacker from re-entering while you remediate secondary systems.

02.

Map Exposed Records & Affected Data Principals

Audit precisely which systems, file repositories, and user databases were touched. Catalog what categories of personal data were stored in those directories: client PAN records, Aadhaar numbers, GST returns, bank account statements, salary sheets, employee health records, or privileged litigation briefs.

03.

Preserve Digital Evidence & Chain of Custody

Preserve log files across domain controllers, firewalls, cloud audit trails (AWS CloudTrail, Azure Monitor, Google Cloud Logging), and endpoint detection systems. Capture forensic bit-stream disk images of affected drives where possible, retain raw phishing emails in RFC 822 .eml format with complete headers, and store ransom notes securely. Do not alter or truncate log files.

04.

Assess Third-Party Vendor & Sub-Processor Liability

If the breach originated in or impacted an external software vendor (e.g., hosted Tally cloud, SaaS CRM, outsourced payroll processor), invoke the security breach notification clause in your Data Processing Agreement (DPA) immediately. Demand written confirmation of breach scope and containment status.

05.

Draft Transparent Customer & Regulatory Notices

Under DPDP Rules (Rule 7), Data Fiduciaries must notify the Data Protection Board and affected individuals without delay. Draft clear, candid communications outlining: what occurred, the specific categories of data involved, containment measures enacted, and explicit defensive recommendations for affected individuals (e.g., updating banking credentials or watching for fraud calls).

06.

Brief Internal Staff & Enforce Communications Discipline

Conduct an internal briefing so employees understand what has occurred, who is authorized to speak with clients, and what specific talking points to provide. Strictly prohibit employees from discussing the incident on public social media, informal WhatsApp group chats, or personal forums.

Who to Notify: Incident Escalation Matrix

Different regulatory entities, commercial partners, and individuals require notification at varying intervals. Use this escalation matrix to prioritize outreach during the first 24 hours:

Stakeholder / Authority	Notification Window	Statutory Basis / Objective
CERT-In	Within 6 hours of noticing	Mandatory incident reporting under CERT-In Directions, 2022.
Data Protection Board of India	Without delay; full dossier in 72 hours	Compliance with DPDP Act, 2023 & Rule 7 of DPDP Rules, 2025.
Affected Clients & Employees	Without delay, upon identification	Statutory requirement under DPDP; empowers victims to implement protective measures.
Cyber Insurance Carrier	As early as policy mandates (typically 12–24h)	Failure to provide prompt notice may compromise claim reimbursement and legal defense coverage.
Interconnected Vendors & Partners	Promptly upon suspecting a shared link	Enables partner networks to revoke federated API tokens and sever exposed integrations.
Commercial Banks & Payment Gateways	Immediately if payment credentials are involved	Freezes compromised corporate accounts, prevents unauthorized wire transfers, and mitigates financial fraud.
Law Enforcement / National Cyber Crime Portal	Promptly in extortion, fraud, or ransomware	Lodge complaints via the National Cyber Crime Helpline (1930) or cybercrime.gov.in for financial fraud.

Guiding Principle: Be transparent, factual, and concise in every advisory. Evasive or delayed notifications destroy client goodwill and professional reputation far more severely than the technical breach itself.

How Lupyd Helps: Out-of-Band War Room & Prevention

When your standard corporate communication systems (such as Microsoft 365, Slack, or Google Workspace) are suspected of compromise, your incident response team requires an isolated communication channel that adversaries cannot access or monitor. Lupyd is a sovereign, end-to-end encrypted workspace built in India that supports both emergency response coordination and baseline breach prevention.

1. During an Active Incident: A Zero-Knowledge War Room

Incident Response Requirement	How Lupyd Delivers
Private Out-of-Band Incident Channel	Spin up a dedicated war room channel in seconds. Group conversations are cryptographically protected using Messaging Layer Security (MLS), ensuring only explicitly invited participants hold decryption keys.
Strict Access Segregation	Granular role-based permissions allow you to onboard legal counsel, external forensics specialists, and senior partners into specific incident channels without exposing general workspaces.
Secure Evidence & Log Sharing	Volatile forensic logs, memory dumps, screenshots, and compliance draft files are encrypted on-device via AES before transmission, ensuring intermediate servers cannot read sensitive payloads.
Encrypted Incident Calls & Screen Sharing	Conduct urgent triage briefings via end-to-end encrypted voice and video calls with real-time screen sharing directly inside the response channel, without relying on external conferencing providers.
Confidential Bilateral Strategy Calls	One-on-one direct messages and calls utilize the Signal Protocol (Double Ratchet + X3DH), with ephemeral cryptographic keys generated and stored solely on local devices.
On-Device Search & Audit Trace	Perform instant full-text searches across incident timelines and shared artifacts entirely on your local machine; search queries never touch cloud servers.

2. Before an Incident: Hardening Your Everyday Perimeter

A significant proportion of data breaches in Indian professional practices trace back to fragmented workflows: client tax returns, Aadhaar scans, and privileged advice dispersed across informal WhatsApp chats, shared personal cloud folders, and unencrypted email threads.

Consolidating sensitive client communications into a unified, end-to-end encrypted platform dramatically shrinks your firm's attack surface:

Eliminates Third-Party Cloud Reading: Lupyd stores no decryption keys on central servers. Even if relay infrastructure is targeted, adversaries obtain only impenetrable ciphertext blobs.
Instant Offboarding & Key Invalidation: When an employee or intern leaves, removing them from the workspace immediately triggers MLS cryptographic epoch rotation, preventing departed personnel from accessing subsequent discussions or files.
Zero Tracking Telemetry: Lupyd does not track user behavioral habits, sell metadata, or serve commercial advertisements, maintaining absolute confidentiality for high-stakes business operations.

Meet Lupyd: The Workspace Where Nothing Leaks

If your firm is looking to modernize its security architecture, here is an executive summary of Lupyd's foundational design:

What Lupyd Is

Lupyd is a secure team collaboration workspace engineered specifically for privacy-first operations. It combines team channels, direct messaging, file distribution, and encrypted calling into a seamless experience comparable to Slack or Microsoft Teams, but engineered with zero-knowledge end-to-end encryption by default. Decryption keys remain exclusively on your team's hardware endpoints.

Who It Is Built For

Chartered accountancy firms, law practices, investment consultancies, healthcare providers, startups, and enterprise organizations managing sensitive personal records, financial audits, or privileged corporate secrets.

Key Architectural Features

Structured Channels & Workspaces: Organize discussions into client-specific rooms, practice verticals, or isolated incident war rooms.
Dual-Layer Cryptography: Signal Protocol for bilateral chats; IETF Messaging Layer Security (MLS) for scalable group channels; AES for files.
Fine-Grained Access Controls: Define custom team permissions, manage invite tokens, and instantly revoke credentials.
Encrypted Voice & Video Calling: Integrated WebRTC conferencing with live screen sharing directly inside channels.
Zero-Knowledge On-Device Search: Search historical communications in milliseconds without leaking search strings to external servers.
Cross-Platform Sync: Native applications available on macOS, Windows, Linux, and Android, with iOS currently in development on the public roadmap.

Transparent Pricing

A generous free core tier designed for standard team communication, alongside professional tiers for growing organizations requiring expanded administration and compliance capabilities. Review current subscription tiers.

Deploy Lupyd in Three Simple Steps:

Download Lupyd for your desktop or mobile operating system.
Create your organizational workspace and configure dedicated channels (e.g., dedicated client matter rooms and an offline emergency incident response room).
Invite team members and assign role-based permissions according to the principle of least privilege.

For an architectural deep dive into our cryptographic implementations, visit the Lupyd Documentation.

Common Incident Response Mistakes to Avoid

Under the intense pressure of a breach, organizations frequently commit operational errors that exacerbate legal penalties, invalidate insurance claims, or complicate recovery:

1. Discussing the Breach on In-Band Channels

If an attacker has established persistence within your email system, Slack, or corporate chat, they can observe your triage discussions, predict containment actions, and accelerate data exfiltration or ransomware encryption before you can intervene.

2. Wiping or Rebuilding Systems Prematurely

Re-imaging laptops or wiping servers immediately may seem proactive, but it irreversibly destroys evidence. Without forensically valid disk and memory artifacts, you cannot determine root cause, establish the breach timeline, or fulfill statutory CERT-In disclosure requirements.

3. Paying a Ransom Without Professional Guidance

Paying an extortionist does not guarantee decryption keys will work or that stolen records will not be published or sold. Furthermore, ransom transfers can trigger anti-money laundering and counter-terrorist financing complications. Always consult cyber defense specialists and legal counsel first.

4. Delaying Disclosures While Seeking Complete Certainty

The CERT-In statutory deadline is 6 hours, and DPDP rules mandate initial notice without delay. Waiting for a complete 50-page forensic report before reporting violates Indian regulations and invites severe administrative penalties.

5. Under-Informing Affected Clients

Dismissing a major client record leak as a "minor technical glitch" destroys firm credibility once affected parties uncover the reality. Transparent, factual communication safeguards long-term professional relationships.

6. Failing to Remediate the Root Cause

Restoring databases from backup without neutralizing the adversary's original entry mechanism (such as an unpatched VPN appliance or compromised API key) invites immediate reinfection.

Your 24-Hour Breach Checklist

Print this checklist or pin it inside your emergency incident response workspace so your team can execute systematically under pressure:

Phase 1: Hour 0–1 (Containment & Triage)

✓ Record exact discovery timestamp, reporter identity, and initial anomaly vector.
✓ Verify indicators of compromise (unusual logins, unauthorized processes, ransom notes).
✓ Isolate affected devices and cloud instances from the local network (do NOT power down).
✓ Reset credentials, revoke OAuth tokens, and terminate active web sessions on suspect accounts.
✓ Migrate all incident triage discussions to an out-of-band, end-to-end encrypted channel.

Phase 2: Hours 1–6 (Mobilization & CERT-In Notice)

✓ Name an Incident Commander and formally designate Technical, Legal, and Communications leads.
✓ Notify external IT retainers, forensic investigators, privacy counsel, and cyber insurers.
✓ File initial mandatory cybersecurity incident notice with CERT-In within 6 hours.
✓ Initialize a real-time, chronological incident log recording every action and timestamp.

Phase 3: Hours 6–24 (Forensics, Assessment & Stakeholder Outreach)

✓ Locate and close the primary entry point (phishing, vulnerability, compromised credentials).
✓ Catalog compromised data stores and compile a roster of affected data principals.
✓ Secure forensic bit-stream disk images, volatile memory captures, and authentication logs.
✓ Invoke vendor breach clauses if third-party software or cloud processors are involved.
✓ Draft statutory notices for the Data Protection Board and transparent advisories for clients.
✓ Brief internal employees on authorized messaging and enforce strict non-disclosure policies.

Frequently Asked Questions

What is the very first thing to do after discovering a data breach?

Record the precise timestamp of discovery, then isolate affected endpoints from the network and revoke compromised credentials. Never wipe or reboot systems, as doing so destroys vital in-memory forensic evidence.

How quickly must a cybersecurity incident be reported in India?

Under the CERT-In Directions (2022), covered organizations must report specified cyber incidents to CERT-In within 6 hours of noticing them. Preliminary facts are sufficient for the initial filing.

Do Indian businesses have to notify clients about a data breach?

Yes. Under the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025, Data Fiduciaries must notify each affected data principal (person) without delay regarding a personal data breach, in addition to informing the Data Protection Board.

Should an organization pay a ransomware demand?

Security professionals, legal counsel, and government authorities strongly advise against paying ransom. Payment does not guarantee data recovery, incentivizes further extortion, and may trigger legal and regulatory violations.

Where should our incident response team coordinate during a breach?

On an out-of-band, end-to-end encrypted messaging platform completely separated from your everyday corporate email and chat infrastructure. Using a zero-knowledge tool like Lupyd prevents attackers with network persistence from reading your response plans.

How can an Indian firm prepare before a breach ever occurs?

Appoint pre-designated incident owners, keep an updated offline checklist, set up an encrypted emergency war room workspace in advance, audit third-party vendor risks, and consolidate sensitive client records into zero-knowledge encrypted channels.

The Bottom Line & Related Reading

A data breach is an intensely high-stakes event, but navigating the first 24 hours requires methodical execution: contain immediately, report to CERT-In within 6 hours, forensically investigate, and transparently notify stakeholders. Teams that prepare beforehand with designated roles, a tested checklist, and an out-of-band encrypted war room resolve incidents faster and mitigate existential regulatory penalties.

Establish your sovereign, encrypted incident response workspace before an emergency strikes. Try Lupyd and empower your team with zero-knowledge end-to-end encryption for confidential client operations and secure incident triage.

Sources & Statutory References:

Last updated: 23 October 2026. This article is general information and not legal advice. Regulatory directives, statutory rules, and cybersecurity mandates evolve; always verify reporting timelines with primary authorities and counsel.