If You Suspect a Card Data Breach: What to Do First

Contain it without destroying evidence

The FTC's guide, Data Breach Response: A Guide for Business, says to move quickly to secure systems and fix the vulnerabilities that may have caused the breach. Its steps include: secure physical areas related to the breach and change access codes if needed; assemble a response team, which may include forensics, legal, information security, IT, operations and management; consider independent forensic investigators; take all affected equipment offline immediately, but do not turn machines off until the forensic experts arrive; update credentials and passwords; interview the people who discovered the breach; document the investigation; and do not destroy forensic evidence. Wiping a till computer or reinstalling a web server before it is examined is exactly what the guide warns against.

Tell your payment provider early

Card data breaches bring in the card networks. Visa's Core Rules (18 April 2026) say a member must comply with Visa's What To Do If Compromised guide, investigate suspected or confirmed compromises by its agents or merchants, and immediately report them to Visa; in the US region, the report may be made on the member's behalf by its agent or by a merchant. On Visa's request, the member or its agent must give access to premises and systems, and must engage a PCI Forensic Investigator; if it does not, Visa may engage one and assess the costs to the member. The same rules require members to make sure their merchant contracts set out merchants' security responsibilities and the liabilities for failing to meet them. In practice, your acquirer will pass these duties to you through your merchant agreement, so call your provider's risk or security team as soon as you suspect a problem and read the security section of your agreement.

Work out who you must notify

The FTC guide says to notify law enforcement, affected businesses and affected individuals. It says all states, the District of Columbia, Puerto Rico and the Virgin Islands have laws requiring notification of security breaches involving personal information, and that other laws may apply depending on the information involved. State laws differ, so check the laws that apply to you with counsel rather than relying on a summary. If card or bank account numbers were stolen and you do not maintain those accounts, the FTC says to notify the institution that does so it can watch for fraud. Separately, the FTC Safeguards Rule applies to businesses that are financial institutions under its definition; the FTC lists examples such as mortgage lenders, payday lenders, finance companies, collection agencies and tax preparation firms. A covered financial institution must notify the FTC as soon as possible and no later than 30 days after discovering a security breach involving at least 500 consumers' unencrypted information. In Canada, the Office of the Privacy Commissioner says organizations subject to PIPEDA must report breaches that pose a real risk of significant harm, notify affected individuals, and keep records of all breaches, whether or not they are reportable. Provincial privacy laws may also apply, so check those too.

Communicate carefully

The FTC recommends a communications plan that reaches employees, customers, partners and other stakeholders, and warns against misleading statements or withholding details that would help people protect themselves. It suggests consulting law enforcement about the timing of notices so they do not hamper an investigation, naming one point person, and explaining what happened, what information was taken, what you are doing, and how people can reach you. It also suggests telling people how you will contact them in future, which helps them spot phishing that uses the breach as cover.

Fix the cause and hold less data

After containment, the FTC guide says to check what service providers can access and verify their fixes, review whether network segmentation contained the breach, and find out whether encryption was enabled. PCI SSC notes that encryption alone is generally not enough to take cardholder data out of PCI DSS scope, while a PCI-listed point-to-point encryption solution can significantly reduce the requirements that apply. Tokenization and hosted payment pages reduce how much card data your systems ever touch. Illustrative example only, with made-up details: a shop with four terminals finds a tampered reader on one. It unplugs that reader from the network without powering it down, photographs it, stops using it, calls its payment provider's security line and a lawyer, and writes down who noticed what and when. It does not replace the device or wipe the till until the investigator says so. This is general information, not legal advice (September 17, 2026).