The essentials in 30 seconds
- The first 24 hours are for qualifying what got out, containing the channel, preserving evidence and preparing the notification.
- The GDPR’s 72-hour deadline runs from the moment you become aware: timestamp the opening of the incident, notify in stages if needed.
- Every finding from the lessons learned becomes a scenario replayed with synthetic data, to prove that the fix holds.
Incident response after a data leak is decided in the first 24 hours: qualifying what got out, containing the exfiltration channel, preserving evidence and preparing the notification. If personal data is involved, the GDPR (Article 33) requires the CNIL to be notified within 72 hours of becoming aware of the breach, unless the breach presents no risk to individuals. The first 24 hours therefore serve to make that notification possible and accurate.
This article describes an hour-by-hour sequence, from the defender’s side, then shows how to turn the lessons learned into replayable tests. For the general framework of exfiltration testing, see our page Data exfiltration testing: definition, method and stakes.
Why exfiltration changes the nature of the incident
A workstation encrypted by ransomware is visible. An exfiltration is not. It is often discovered late, by a third party, a volume alert or a public claim. The teams’ first reflex is to look for the malware. That is a mistake of priority. The question that matters is: which data has left the scope, through which channel, and is the channel still open?
In double extortion attacks, exfiltration precedes encryption and serves as leverage for blackmail. The subject is developed in Ransomware and double extortion: exfiltration is the step to test.
The first 24 hours step by step
Diagram · the first 24 hours
H0 to H2: declare and timestamp
- Open the incident formally with a written time of awareness. That is what starts the 72-hour clock, not the time of the attack.
- Set up the core team: CISO or SOC manager, DPO, CIO, legal, communications on standby. A single owner for the logbook.
- Choose an out-of-band communication channel if email or the directory may be compromised.
- Notify the cyber insurer if the policy requires it within a short deadline.
H2 to H6: contain without destroying evidence
Containment targets the egress channel above all. Block the identified destinations at the proxy and the firewall, revoke the tokens and sessions of suspect accounts, isolate the affected workstations from the network without switching them off. Switching a machine off wipes its memory, often the only useful trace.
H6 to H12: qualify what got out
The SOC reconstructs the timeline from the logs: proxy, DNS, firewall, SaaS audit logs, endpoint agents, email gateway. Three questions structure the work:
- What: which categories of data (personal, health, trade secrets, customer data) and roughly what volume.
- How: which channel (HTTPS to cloud storage, DNS, email, removable media, collaboration tool).
- Since when: the first known exit, often well before detection.
If data classification is missing, this step becomes archaeology. The link between the two is explained in Why DLP depends on data classification. For the detection method itself, see Detecting exfiltration: the SOC method and how to measure time to detection.
H12 to H24: assess the risk and prepare the notification
The DPO assesses the risk to the data subjects: nature of the data, volume, possibility of identification, possible consequences. This assessment determines what comes next.
What the GDPR requires, and what it does not
| Obligation | Text | Deadline or condition |
|---|---|---|
| Notify the CNIL | GDPR, Article 33 | Without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals |
| Justify a delay | GDPR, Article 33 | A notification made after 72 hours must be accompanied by the reasons for the delay |
| Notify in stages | GDPR, Article 33 | The information may be provided in phases if not everything is known |
| Inform the individuals | GDPR, Article 34 | When the breach is likely to result in a high risk |
| Document every breach | GDPR, Article 33 | Internal register, including for breaches that were not notified |
Practical point: notification in stages is your ally. Do not delay the initial declaration while waiting for a perfect qualification. An initial notification at H48 with additions afterwards is better than an exhaustive notification at H90. The CNIL offers a dedicated online service. A processor, for its part, must warn the controller without undue delay: if the leak occurs at a service provider, see Data leakage at third parties and processors.
Depending on your sector, other regimes may apply on top (NIS2, DORA for financial entities), with their own deadlines and authorities. Check them in your response plan before the incident, not during it.
A concrete scenario: a CRM export to personal storage
Tuesday, 4 pm. A volume alert flags an unusual upload from a sales representative’s workstation to a consumer storage service. The SOC confirms that a CRM export containing customer names, email addresses and phone numbers was sent.
- 4:30 pm: incident opened, time of awareness recorded.
- 6 pm: account session revoked, storage domain blocked for this workstation, workstation isolated.
- Wednesday 10 am: timeline established, a single exit identified, data categories known.
- Wednesday 3 pm: the DPO concludes there is a risk to individuals, preparation of the initial notification.
The real question from the lessons learned comes next: why did the DLP rule that was supposed to block this type of file going to a personal cloud do nothing? This case is typical of the everyday leaks described in Personal cloud, Teams, Slack: the everyday data leaks.
Next step
Has your last incident become a replayed test?
A 30-minute guided demo, on pre-built result sets: the campaign across the 8 channels covered, the report and its detail, nothing to install. The POC then replays one standard scenario with synthetic data, from a representative machine in your network, through your real egress controls. What actually gets out through your egress paths is what the pilot shows you.
From lessons learned to tests
A classic lessons-learned exercise produces a document. It is read once, then forgotten. The more useful method is to convert each finding into a replayable attack scenario, with synthetic data.
The conversion points
- The channel used is described as a testable scenario (data type, channel, destination, user context).
- The fix applied has a verifiable expectation: blocked, alerted, or logged.
- The scenario is replayed right after the fix, to prove that it works.
- It is then replayed at regular intervals, because an agent or policy update can break it silently.
- Close variants of the channel (another format, another service, another workstation) are added to the test set.
- The results feed an indicator tracked over time, not a box ticked.
Frequently asked questions
Does the 72-hour deadline start from the attack or from detection?
From the moment the controller becomes aware of the breach. Hence the importance of timestamping the opening of the incident and documenting the qualification steps.
Must the CNIL be notified if the exfiltrated data was encrypted?
Not necessarily. If the breach is unlikely to result in a risk, for example because the data is unintelligible and the key is not compromised, notification may not be required. The breach must still be documented internally.
What if you still do not know what was stolen at H72?
Notify with the information available, then complete it. The GDPR explicitly provides for communication in phases.
Should compromised machines be switched off?
As a general rule, no: isolate them from the network. Switching them off destroys traces in memory that are useful for understanding the exfiltration channel.