Hacked? Here’s what to do next
Hi Everyone,
In 2016, hackers stole personal data belonging to 57 million Uber riders and drivers.
Uber's head of security tracked the hackers down, paid them $100,000 through the company's bug bounty program, and had them sign papers describing the theft as security research.
A jury convicted him of obstruction of justice, and the conviction survived appeal last year.
He believed he was protecting the company. But the actions that feel protective in the first 24 hours of a cyber incident are often the ones that create the real damage.
Today, we're covering the three instincts to resist when your company gets hacked.
Instinct 1: "Call IT and fix it now"
Chuck Kraus, a Texas attorney who handles breach response, tells clients: "Retain outside counsel first, and have counsel engage the forensic investigators."
When your lawyer hires the forensics team, the report explaining what went wrong can stay confidential.
When your IT team runs the same investigation on their own, every lawyer who files a lawsuit afterward can request that report.
Same investigation, same findings, but very different legal exposure.
In practice, the first hour looks like this. You call the lawyer. Your IT person disconnects affected systems from the network at the same time. And nothing gets wiped, deleted, or rebuilt. That destroys the evidence forensics needs to establish what was taken, and what was taken determines who you're legally required to notify.
Instinct 2: "Reassure everyone fast"
In October 2024, the SEC fined four public companies a combined $7 million for playing down real intrusions.
Unisys paid $4 million after calling its cyber risk "hypothetical" while knowing attackers had taken gigabytes of data.
Avaya told investors the attackers had accessed a "limited number" of emails. Its own investigation had found at least 145 stolen files.
If your first statement later proves wrong, the correction can do more damage than taking a little longer to get the facts straight. On day one, say three things:
- What you know
- What you don't know yet
- When people will hear from you again
Nothing more.
Instinct 3: "Keep it inside the company"
This was Uber's choice, and it's the most understandable one. Disclosure feels like inviting lawsuits and panic.
But regulators punish the concealment, not the breach. Every penalty we mention in this issue came from what happened after the attack, never from the attack itself.
And the law doesn't give you much time. Under GDPR, you have 72 hours from becoming aware that personal data was compromised to notify the authority. Several US states now set fixed deadlines.
Missing the deadline is its own violation. The regulator fines you for the late report, separately from anything else.
Prepare for it now
Every decision in this issue can be made right away with the card we prepared for you. We recommend printing it, just in case you can't access your server or Drive.
Fill out your cyber accident card
And since the deadlines and rules vary by country and state, the first line of the card — the lawyer — is the one that covers you for the rest.
Go deeper
👉 Kraus Law: Data breach response: the first 72 hours — walk through the full hour-by-hour sequence, including the deadlines and the structural choice most businesses get wrong.
👉 SEC: SEC charges four companies with misleading cyber disclosures — read what each company said versus what it knew, so your own first statement never ends up in a filing like this.
👉 Microsoft: Hackers hit Norsk Hydro. The company responded with transparency — see what the opposite of a cover-up looks like, from a company that got hit hard and came out with its reputation stronger.
👉 Justia: United States v. Sullivan, Ninth Circuit opinion — the full story of the Uber case, worth 15 minutes if you want to understand exactly where "protecting the company" became a crime.
Coming up tomorrow
Tomorrow, we will show you how to tell a market problem from a sales problem using two numbers you already have in your CRM.
That's it for today!