After A Cyber Breach, Avoid These Mistakes
Breaches are high-pressure events, and pressure leads to mistakes. Unfortunately, those mistakes can turn a manageable incident into a full-blown disaster. Sean Mack, the founder of CXO Advisor sees several common errors repeated time and again by small and mid-sized businesses.
Destroying Evidence Too Soon
“One of the most common mistakes is deleting logs or reimaging machines before conducting forensics,” Mack explains. “Getting that forensic information is critical.”
Many companies, in a rush to restore systems, delete logs or reimage machines before investigators can analyze them. Mack recalls a client whose system logs rotated out before they were collected, erasing critical details about attacker behavior. The result? The threat was removed, but the business had no way of knowing the full scope of the compromise—or whether vulnerabilities remained.
Failing to Involve Legal Counsel
The second mistake is failing to involve legal counsel quickly enough. Every breach carries regulatory implications. Many states require notification within 72 hours, and industries like healthcare and finance face additional mandates under HIPAA, PCI DSS, and others. Missing deadlines or failing to notify properly can result in lawsuits, fines, and reputational damage.
Alerting the Attacker Prematurely
Another misstep is alerting the attacker.
“You don’t want to make public statements or contact vendors until containment is complete,” Mack warns. “If the attacker knows that you’re aware of their activity, they may take additional steps or accelerate their timeline.”
Companies sometimes rush to make public statements or notify partners before containment is complete. Once adversaries realize they’ve been discovered, they may accelerate their attack—stealing more data, locking systems with ransomware, or sabotaging recovery.
Miscommunication With Customers
Finally, miscommunication is a recurring challenge. In their eagerness to reassure customers, organizations sometimes release inaccurate or incomplete information. In a rapidly evolving incident, that can backfire. The key, Mack notes, is to balance transparency with accuracy. Customers must be informed, but only with facts that are verified.
Avoiding the Pitfalls
The takeaway is clear: small businesses need a disciplined approach. Evidence must be preserved, legal and insurance experts engaged early, and communications carefully controlled. By learning from these common mistakes, companies can avoid compounding the damage of a breach.
Watch the full interview with Sean Mack below:
Post-Breach Essentials for Small Businesses
ISMG CXO Advisory Practice’s Sean Mack on Immediate Actions and Long-Term Recovery