The short answer
Contain but do not destroy: isolate affected systems, preserve logs and images, stop card processing on compromised devices, notify your acquirer immediately, and engage counsel before communicating externally. Card-brand rules require prompt notification and may mandate a forensic investigator.
Preserve evidence
Wiping or rebuilding compromised systems destroys the evidence a forensic investigator needs, which can make the outcome dramatically worse. Image first, remediate after.
Notification obligations
Under PIPEDA in Canada, Law 25 in Quebec and US state breach laws, notification duties differ by jurisdiction and by risk of harm. Counsel should map this before any customer communication goes out.
Key takeaways
- Preserve evidence before remediating
- Notify your acquirer immediately
- Engage counsel before external communication
Want this checked against your own statement?
We are an independent agent — we shop every processor we work with and bring you the best deal for your profile. Free analysis, every fee named, back within 4 hours. Or call now and we will quote you on the phone.