In this article · 7 sections
A leaked contact-form database, a hacked admin account or a misconfigured backup can expose customer data. A website data breach needs quick, organised action, both technical and legal.
Hour 0–6: Contain and report
- Contain: disable compromised accounts, change passwords and API keys, take vulnerable pages offline
- Preserve evidence: server logs, access logs, timestamps. See evidence collection
- CERT-In: the 2022 directions require covered entities to report specified incidents within 6 hours of noticing them. Check whether you're covered and report via CERT-In's channels
Day 1: Assess
- What data was exposed? Names, phones, emails, addresses, IDs, payment details?
- How many people?
- How did it happen? Vulnerable plugin, weak password, public backup file?
- Is it still happening?
Day 1–3: Notify
- Data Protection Board and affected people under the DPDP Act and Rules, in the prescribed form and timelines. See DPDP Act compliance
- Customers: explain what happened, what data, the risks (e.g. scam calls) and what you're doing
- Payment gateway / bank if payment data may be involved
- Police / cybercrime.gov.in for theft or extortion
Fix the root cause
- Patch software. See website hacked recovery
- Remove public backups and test files
- Enable 2FA for admin, hosting and email
- Review who has access, including old agencies and staff
- Store only the data you need
Warning customers about scams
After a leak, scammers often call customers pretending to be you. Tell customers your official numbers and that you'll never ask for OTPs or advance payments to personal UPI IDs.
Hosting with Joboo Web?
Contact us immediately so we can help preserve logs and secure the account. Legal or data complaints can also be submitted via our legal request form.
FAQs
Should I pay a hacker who demands money?
Report extortion to the police; payment doesn't guarantee deletion.
Is a leaked email list a "breach"?
Yes. Any unauthorised access or disclosure of personal data can count.
This article is general information, not legal advice.
Was this article helpful?
Your answer helps us improve our guides