A data breach is what happens when someone gets into your systems or files without permission and sees, copies or steals information they should not have — customer names and phone numbers, order details, passwords, or business records. It sounds like something that only happens to big companies, but small businesses are targeted often, precisely because attackers expect their defences to be weaker. As an IT manager, I treat breach readiness as part of the job, not as something to think about afterwards: what you do in the first hours decides how much damage a breach does.

This guide explains what a data breach is, how it usually happens, and the practical steps to take if it happens to your business.

How Breaches Usually Happen

Most breaches do not involve a genius hacker breaking through a firewall. They happen through ordinary, everyday weaknesses:

• Phishing emails. Someone on your team clicks a link or opens an attachment in a convincing-looking email, and the attacker gains access to their account. This is the most common route in, and my guide on how to spot a phishing email covers the warning signs.
• Weak or reused passwords. One password used across many accounts means a leak from one service opens all of them. A password manager and two-factor authentication close this gap almost completely.
• Unpatched software. Old versions of a website platform, a plugin or an operating system often contain known security holes. Attackers scan for them automatically. Keeping everything updated is one of the cheapest defences there is.
• Lost or stolen devices. A laptop or phone without a screen lock or encryption can hand over emails, saved passwords and business files to whoever finds it.
• Too much access. When everyone on the team can see everything, one compromised account exposes the whole business. Limiting access to what each person actually needs reduces the damage.

Signs You May Have Had a Breach

A breach is not always obvious. Watch for these warning signs: logins from places or devices you do not recognise, password reset emails you did not request, customers reporting strange messages that appear to come from you, files that have been changed or deleted without explanation, or your website behaving strangely — new admin users, unexpected redirects, or a sudden flood of spam. If you see one of these, do not assume it is a glitch. Investigate it the same day.

The First 24 Hours: What to Do

Stay calm and work through the steps in order. Speed matters, but panic makes things worse.

1. Contain it

First, stop the bleeding. Disconnect the affected computer from the network if needed, change the passwords of the accounts involved, and revoke any active sessions. If your website is affected, put it in maintenance mode while you investigate, and contact your hosting provider — they can often see what happened from their side.

2. Find out what was accessed

Work out what the attacker could see: which accounts, which files, which customer records. Check login logs, file access records and your website's admin activity. You need this answer before you can tell anyone else anything useful, so do not skip it or guess.

3. Secure the accounts

Change every password connected to the affected accounts, turn on two-factor authentication everywhere it is available, and remove any admin users or API keys you do not recognise. If you use a password manager, this is the moment it earns its keep — see my guide on why every business should use a password manager.

4. Tell the people affected

If customer information was exposed, tell those customers plainly: what happened, what information was involved, what you have done about it, and what they should do — usually changing their password and watching for suspicious messages. People are far more forgiving of an honest, quick notification than of finding out later from someone else.

5. Keep records

Write down everything: when you noticed the problem, what you found, what you changed and who you told. These notes matter if a customer, a payment provider or an authority asks questions later, and they help you fix the real cause instead of just the symptoms.

After the Dust Settles

Once the immediate problem is contained, find the root cause and fix it. Was it a phishing email? Then your team needs a short training session and possibly stricter email filtering. Was it an unpatched plugin? Then set a weekly update routine and check it actually happens. Was it a weak password? Then enforce a password manager for the whole team.

Also check your backups. A breach sometimes comes with damaged or deleted files, and a clean, recent backup is the fastest way back to normal. My guide on how to back up your website sets out a routine that works for a small business.

Reducing the Risk Before It Happens

You cannot prevent every attack, but a few habits cut the risk dramatically: two-factor authentication on every account that offers it, unique passwords stored in a password manager, software and plugins updated on a schedule, a short security briefing for every new team member, and a backup you have actually tested by restoring from it. None of these is expensive. All of them are cheaper than a breach.

Frequently Asked Questions

What counts as a data breach?

Any unauthorised access to data that should be private — customer details, passwords, order records, business documents. It does not have to involve money or a large number of people to count.

Do small businesses really get targeted?

Yes. Attackers often use automated tools that scan thousands of small websites and inboxes looking for known weaknesses. A small business is not too small to be attacked; it is simply easier to attack than a large one.

Should I tell my customers about a breach?

If their information was exposed, yes — promptly and honestly. Explain what happened, what was involved, what you have done and what they should do. Hiding it almost always makes the consequences worse.

How long does it take to recover from a breach?

The technical fix can take hours or days, depending on what happened. Rebuilding customer trust takes longer, which is why fast, honest communication matters as much as the technical response.

Final Thoughts

A data breach is a stressful event, but it is a manageable one if you have thought about it in advance. Know the signs, know the first five steps, keep your passwords and updates in order, and keep a backup you can rely on. And if it happens, act quickly, tell the truth, and fix the cause — that combination limits the damage and, over time, can even strengthen the trust your customers have in you.