Preserve evidence and record what happened

Two duties sit alongside reporting and containment in the first hours: keep the evidence, and write down the facts.

Never cover up, never delete evidence

The absolute rule of breach response is that you never conceal an incident and never destroy evidence of it. Do not delete the misdirected email from your sent items to hide it. Do not wipe logs, purge chat messages, or quietly re-image a compromised machine before anyone has examined it. Do not ask a recipient to "just forget" what they received instead of reporting it.

Covering up transforms the situation completely. A breach is usually a process failure, and regulators and employers treat it as one. A cover-up is a deliberate act by an individual. It can turn an ordinary incident into a disciplinary matter or worse, it deprives your organisation of the facts it legally needs for assessment and notification, and it almost always comes out anyway, at which point every earlier statement is doubted too.

Preserve first, tidy later

Evidence tells the responders what actually happened: what data was involved, who accessed what, and when. Preserve the original email and its recipient list, screenshots of error messages, system and access logs, the affected device itself, and any replies from recipients. If in doubt whether something is evidence, keep it and ask.

Record what happened while it is fresh

Memory degrades fast under stress. As soon as the urgent steps are done, write a short factual note:

• What happened, in plain terms
• When it happened, and when you noticed
• What data and roughly how many people appear to be involved
• What you did, with times: report made, recall attempted, who you spoke to

Stick to facts you observed, not guesses about blame or severity. This note feeds the formal incident record, supports the 72-hour assessment covered in the next section, and protects you by showing you acted promptly and properly. In breach response, the person with a timeline is always in a stronger position than the person with a vague recollection.