What Is a Security Breach? How to Respond When Attackers Get In
It’s 2 a.m., and IT just confirmed unauthorized access to your customer database. A security breach is any incident where someone gains unauthorized access to systems, networks, or data, whether through hacking, a stolen password, or an exploited vulnerability. What happens in the next 72 hours decides your legal exposure in every state your customers live in.
What Is a Security Breach?
A security breach is an incident in which an unauthorized party gains access to a system, network, or data set that was meant to be protected. It covers external attacks, like hacking or phishing, and internal incidents, like an employee viewing records they had no reason to access. Not every breach involves personal data, but the ones that trigger legal notification duties almost always do.
The First Hours After a Security Breach: Confirm, Contain, Preserve, Communicate, Decide
The first hours after a suspected breach follow five steps in order: confirm the incident is real, contain it, preserve evidence, communicate on a need-to-know basis, and decide whether notification thresholds apply. Skipping the order, especially preserving evidence before cleanup, can destroy the forensic trail regulators and insurers will ask for later.
- Confirm: verify unauthorized access actually happened, not a false alarm
- Contain: isolate affected systems without powering them off, which can wipe forensic logs
- Preserve: image affected systems and lock down logs before remediation starts
- Communicate: loop in legal counsel and leadership before any external statement
- Decide: determine which state and federal notification clocks just started running
Why There’s No Single US Breach Notification Law to Follow
The United States has no single federal law requiring breach notification for every business and every type of data. Instead, all 50 states, plus DC and several territories, have their own statutes, each with different triggers, deadlines, and definitions of personal information. A business with customers in multiple states must satisfy every applicable state law at once, not just the one where it’s headquartered.
The Strictest Clock Wins: Navigating a 50-State Patchwork
When a breach affects residents of more than one state, the practical rule is that the strictest applicable deadline governs your response, because missing any single state’s clock is a separate violation. If your affected records include one California resident and one Delaware resident, you’re working against California’s 30-day clock, not Delaware’s 60-day one, even though both technically apply. Most response plans miss this until it’s too late, because they draft a single timeline based on where the company is headquartered instead of where every affected individual actually lives.
Definitions shift as much as deadlines. What counts as personal information triggering notification varies state by state. Some states count a name paired with a driver’s license number; others extend the definition to biometric data, health information, or a username paired with a security question. Oklahoma’s SB 626, effective January 2026, broadened its own personal information definition alongside its new notification deadline. A plan built around one state’s definition will systematically undercount who actually needs to be notified in a multi-state incident. The fix isn’t memorizing 50 laws. It’s building a checklist that always checks the shortest deadline and the broadest applicable definition first.
California’s New 30-Day Rule, and What Other States Are Doing
California’s SB 446 took effect January 1, 2026, requiring notice to affected residents within 30 calendar days of discovering a breach, replacing the old “without unreasonable delay” standard. If the breach affects 500 or more California residents, the state attorney general must also be notified within 15 calendar days of the consumer notices going out.
| State | Individual notification deadline |
|---|---|
| California | 30 calendar days (new under SB 446, effective Jan 1, 2026) |
| New York | 30 days |
| Texas | 30 days |
| Colorado | 30 days |
| Florida | 30 days |
| Delaware | 60 days |
| Most other states | “Without unreasonable delay,” no fixed number |
Oklahoma’s SB 626 took effect the same day and adds its own twist: entities that already comply with GLBA, HIPAA, or the Oklahoma Hospital Cybersecurity Protection Act get limited exemptions from notice content rules, though they still must notify the attorney general if 500 or more residents are affected. Entities with documented, reasonable safeguards can also raise that as a defense against civil penalties.
Federal Overlays: HIPAA’s 60-Day Requirement and Where It Applies
HIPAA’s Breach Notification Rule requires healthcare providers, health plans, and their business associates to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured health information. It applies on top of state law, not instead of it. California treats full HIPAA compliance as satisfying SB 446’s specific notice requirements, but HIPAA-regulated entities are still on the hook for the law’s other obligations, like the attorney general filing.
What Is Identity Theft, and How Does It Follow a Security Breach Downstream?
Identity theft is the use of someone’s stolen personal information, like a Social Security number or account credentials, to commit fraud. It follows a security breach downstream because exposed data doesn’t need to be misused right away. Criminals often hold stolen records for months, then use them in a wave of new account fraud once the headlines fade and victims stop watching their accounts closely.
Insider Threats and External Breaches: Two Different Incidents, One Response Plan
An external breach starts with an attacker outside your organisation: a phished credential, an exploited vulnerability, or malware delivered through a vendor. An insider threat starts with someone who already has legitimate access, misusing it deliberately or by mistake. Both meet the legal definition of a security breach if personal data is exposed, and both trigger the same notification clocks.
Where they differ is detection. External breaches usually leave a technical trail, an unusual login location or an unfamiliar IP address. Insider incidents often look like normal activity right up until the data leaves the building, because the access itself was authorized. Most external breaches still start with social engineering rather than a technical exploit, which is why response plans built only around “hacker gets in” scenarios miss half the risk. They have no playbook for a departing employee who exports a customer list the day before their last shift. The confirm, contain, preserve, communicate, decide sequence works for both, but containment looks different: for an insider, it means revoking access and preserving HR logs, not isolating a server.
Building a Response Plan That Actually Holds Up Across Every Jurisdiction You Touch
A response plan holds up across jurisdictions when it’s built around the strictest applicable deadline by default, not the deadline of your headquarters state. That means mapping where your customers and employees actually live, keeping a current list of each state’s trigger and timeline, and assigning one person to make the jurisdiction call within 24 hours of confirming a breach. Reviewing this list as part of a regular cyber security audit checklist keeps it from going stale as laws like SB 446 and SB 626 take effect.
At Cyber Security Solutions Ltd, the plans that hold up under pressure are the ones tested before a real incident, not written once and filed away.
A Realistic Response Checklist for a Business Without In-House Legal Counsel
Most SMBs don’t have in-house counsel to call at 2 a.m., but a short checklist covers the essentials:
- Confirm and contain before anything else
- Engage outside breach counsel or a fractional CISO early, even for a small incident
- Map every state where affected individuals live, not just where you’re headquartered
- Apply the strictest notification deadline among every state involved
- Document each decision and its timestamp for regulators and insurers
Pair this checklist with ongoing data breach prevention work, since the businesses that respond fastest are usually the ones that already knew what data they held and where it lived.
Conclusion
A security breach isn’t a single bad day, it’s the start of a legal clock, and the states your customers live in set the pace, not your calendar. The businesses that come through a breach intact are the ones that knew their notification map before they needed it. Cyber Security Solutions Ltd helps SMBs and IT teams across the US and UK build and test that response plan before the 2 a.m. call comes in, and cybersecuritysolutionsltd.com has more on where to start.
FAQs
A security breach is broader: any unauthorized access to a system or network, even one where no personal data was touched. A data breach is a specific type of security breach involving exposed personal or sensitive data. Every data breach is a security breach, but not every security breach is a data breach.
Timing depends on which states are affected and what data was involved. California now requires notice within 30 calendar days under SB 446. Other states range from 30 to 60 days, and some use a "without unreasonable delay" standard with no fixed number. HIPAA-covered breaches follow a separate 60-day federal clock.
Yes. State breach notification laws generally apply based on the number of residents affected and the type of data involved, not company size. A five-person business with a breached customer list faces the same 30-day California clock as a large enterprise.
Missing a deadline can trigger regulatory penalties, private lawsuits in some states, and reputational damage on top of the breach itself. Under Oklahoma's SB 626, entities without reasonable safeguards and proper notice face civil penalties of up to $150,000 per breach.
Yes. Most state laws define a breach by whether personal data was accessed without authorization, not by whether the person responsible was an employee or an outsider. An insider who exports customer data without permission triggers the same notification analysis as an external hacker.
Cyber insurance often covers notification costs and legal fees, but it doesn't replace a response plan. Policies frequently require approved breach counsel and can deny claims if deadlines are missed due to delayed reporting, so speed still matters even with coverage in place.
