# Playbook: Breach Response
Source: https://paymentsandrisk.com/docs/playbooks/breach-response

Last updated 23 October 2026.

TL;DR

-   **Hour 0-4**: contain it, preserve evidence, call your processor by phone rather than email
-   **Hour 4-24**: confirm investigation requirements and notify your acquirer formally
-   **Day 1-3**: track network notifications, legal review and scope assessment
-   **Week 1-4**: plan investigation, remediation and compliance validation with the responders
-   **Silence isn't an option.** Contact your processor now; the network table below gives the published windows

Business-Critical

Suspect card data got out? Move now: contain it, preserve evidence and call your processor. Ask who owns the response and which notification deadlines apply.

The clock starts when you suspect a breach, not when you confirm it.

## Workflow Overview

```mermaid
flowchart LR
    A[<b>HOUR 0-4</b><br/>Contain] --> B[<b>HOUR 4-24</b><br/>Notify] --> C[<b>DAY 1-3</b><br/>Investigate] --> D[<b>WEEK 1-4</b><br/>Remediate]

    style A fill:#b42318,color:#fff
    style B fill:#5e4b8b,color:#fff
    style C fill:#9a5b00,color:#fff
    style D fill:#1f6f4a,color:#fff
```

| Phase | Key Actions |
| --- | --- |
| **Contain** | Stop the bleeding, preserve evidence, contact processor |
| **Notify** | Confirm PFI requirements and formal notifications to acquirer and brands |
| **Investigate** | Scope assessment, forensic analysis, affected card identification |
| **Remediate** | Fix vulnerabilities, re-certify, handle fines and liabilities |

Have these on hand before you need them

-   Your processor's emergency contact number
-   Your acquirer's breach notification requirements
-   Your cyber liability policy number, if you carry one
-   Who in the building can sign off on an external vendor at 2am

* * *

## When to Use This Playbook

Start this playbook when you see:

| Signal | Urgency |
| --- | --- |
| Confirmed malware on payment systems | **Immediate** |
| Anomalous outbound data transfers from POS/e-commerce | **Immediate** |
| Card brand notification of fraud cluster | **Immediate** |
| Suspicious files in payment environment | High |
| Unusual database queries on card data | High |
| Third-party breach affecting your data | High |
| Ransomware attack on any systems | High |

**When in doubt, assume breach and start the clock.**

* * *

## Hour 0-4: Contain

### Stop the Bleeding (First 30 Minutes)

```text
□ Isolate affected systems (don't turn off - preserve evidence)
□ Disconnect payment systems from network (if actively exfiltrating)
□ Block suspicious IPs/connections at firewall
□ Change all administrative passwords (payment systems, databases)
□ Disable compromised user accounts
```

Don't

-   **Don't wipe systems** - you'll destroy the forensic evidence
-   **Don't reboot servers** - volatile memory is holding evidence
-   **Don't try to fix it yourself** - you may still need a PFI
-   **Don't discuss it on email or Slack** - assume the attacker is reading

### Preserve Evidence (Hour 1)

```text
□ Take memory dumps of affected systems (if capable)
□ Capture full disk images before any changes
□ Export firewall and network logs (last 90 days minimum)
□ Export database query logs
□ Screenshot any suspicious activity
□ Document timeline: when discovered, by whom, initial observations
```

### Call Your Processor (Hour 1-2)

**Call, don't email.** Email is too slow and may be compromised.

What to say:

> "We have a suspected data security incident affecting our payment environment. We're in containment mode and need to initiate your breach response process."

Ask:

1.  Who is my incident response contact?
2.  What's the formal notification process?
3.  Do you have a preferred PCI Forensic Investigator (PFI)?
4.  What are my immediate obligations?

### Assemble Response Team (Hour 2-4)

| Role | Responsibility |
| --- | --- |
| **Incident Commander** | Single decision maker, coordinates response |
| **IT/Security Lead** | Technical containment and evidence preservation |
| **Legal** | Notification requirements, liability, communications |
| **Finance** | Reserve funds for PFI, fines, customer notification |
| **Communications** | Internal and external messaging (if required) |
| **Vendor Contact** | Point person for processor, PFI, insurance |

* * *

## Hour 4-24: Notify

### Engage a PCI Forensic Investigator (PFI)

Ask your acquirer whether this incident requires a PCI Forensic Investigator. PCI SSC qualifies PFIs; the applicable payment-brand program determines when one is required.

**Confirm before engagement:**

-   Whether the card brand or acquirer requires a PFI
-   Which investigation scope, deliverables and deadlines apply
-   Whether your insurer requires an approved investigator

**How to find one:**

1.  Ask your processor or acquirer for their preferred list
2.  Check PCI SSC's [list of approved PFIs](https://www.pcisecuritystandards.org/assessors_and_solutions/pci_forensic_investigators)
3.  Your cyber insurance may have a panel of approved investigators

**Get a written quote:** investigation scope, urgent work, reporting and exclusions. Check it with your insurer before committing.

### Formal Acquirer Notification (Hour 8-12)

You have to notify your acquirer formally. That's the bank behind your merchant account.

```text
□ Written notification through the channel your acquirer requires; confirm receipt
□ Include: Date discovered, initial scope estimate, containment steps taken
□ Request: Confirmation of receipt, next steps, timeline requirements
□ Ask: Card brand notification requirements and process
```

### Card Brand Notifications (Hour 12-24)

Check each network's clock and your contract. Contact the acquirer now and confirm who will notify each brand.

| Network | Notification Window | Key Requirements |
| --- | --- | --- |
| **Visa** | Within 3 calendar days of reasonable suspicion or confirmation | [Visa compromise guidance](https://usa.visa.com/content/dam/VCOM/download/merchants/cisp-what-to-do-if-compromised.pdf); confirm reporting with your acquirer |
| **Mastercard** | Within 24 hours of awareness of a potential or actual compromise | [Mastercard ADC guidance](https://www.mastercard.com/content/dam/mccom/shared/business/support/rules-pdfs/SPME-Manual.pdf); coordinate through your acquirer |
| **Amex (US)** | Within 72 hours after discovery | [Amex US incident guidance](https://www.americanexpress.com/us/merchant/us-data-security.html); notify Amex separately |
| **Discover** | Confirm immediately with your acquirer and Discover | The [public compliance page](https://www.discoverglobalnetwork.com/solutions/pci-compliance/acquirer-compliance/) gives a reporting contact, doesn't give a notification window; ask Discover and your acquirer for the applicable deadline |

VENDOR Network-published guidance, opened 2026-10-22. Your contract can require earlier notice.

### Document Everything

```text
□ Create incident log (timestamped actions and decisions)
□ Record all phone calls (date, time, who, summary)
□ Save all emails related to incident
□ Document any evidence collected
□ Track hours spent (for insurance claims)
```

* * *

## Day 1-3: Investigate

### PFI Initial Assessment

The PFI will:

```text
□ Deploy forensic tools on affected systems
□ Analyze malware (if present)
□ Determine entry point and attack timeline
□ Identify systems with card data access
□ Estimate date range of exposure
□ Begin card number identification
```

### Scope Assessment

Work out:

| Question | Impact |
| --- | --- |
| **How many cards exposed?** | Determines reissuance liability |
| **What data elements?** | PAN only vs. PAN + CVV vs. track data |
| **Date range of exposure?** | Card brand operational costs |
| **How did attacker get in?** | Remediation requirements |
| **Is attack ongoing?** | Containment priority |

### Legal and Regulatory Review

```text
□ Identify applicable breach notification laws (by state/country)
□ Determine customer notification timeline requirements
□ Review contracts with partners/vendors for notification requirements
□ Assess regulatory reporting obligations (if any)
□ Review cyber insurance policy coverage and notification requirements
```

### Internal Communication

What to tell employees:

-   The incident is under investigation right now
-   Don't discuss it outside the company at all
-   Send every inquiry to the named spokesperson
-   Cooperate fully with the investigators
-   Preserve anything that might turn out to be evidence

* * *

## Week 1-4: Remediate

### Fix the Vulnerabilities

Based on PFI findings, you'll need to address root causes:

| Finding | Typical Remediation |
| --- | --- |
| **Malware on POS** | Clean rebuild, endpoint protection, network segmentation |
| **Unpatched systems** | Patch management program, vulnerability scanning |
| **Weak credentials** | Password policy, MFA implementation |
| **No network segmentation** | Segment payment systems, firewall rules |
| **Third-party compromise** | Vendor security review, access restrictions |

### Re-Certification

After remediation, you may need:

```text
□ PCI DSS re-assessment (if Level 1 or required by acquirer)
□ New SAQ completion (for smaller merchants)
□ Vulnerability scan by Approved Scanning Vendor (ASV)
□ Penetration test (if required)
□ Remediation validation by PFI
```

### Handle Fines and Liabilities

**Potential costs:**

| Cost Category | What to budget from |
| --- | --- |
| **PFI investigation** | Written scope and investigator quote |
| **Card reissuance** | Actual assessment basis from the acquirer or network |
| **Operational costs** | Itemized assessments and internal hours |
| **Non-compliance fines** | Applicable network terms and incident notices |
| **Customer notification** | A quote using the affected-customer count |
| **Credit monitoring** | Quoted service, population and duration |
| **Legal fees** | Counsel's scope and rates |
| **Increased processing rates** | Ask your acquirer for any revised terms in writing and compare them with your pre-incident fees |

### Customer Notification (If Required)

If notification is required by law or contract:

```text
□ Draft notification letter (legal review)
□ Prepare FAQ for customer inquiries
□ Set up dedicated phone line or email
□ Offer credit monitoring if appropriate
□ Document all notifications sent
```

* * *

## Post-Incident: Recovery

### Return to Normal Processing

```text
□ Get written clearance from acquirer
□ Confirm PFI has closed investigation
□ Resume full processing (may be phased)
□ Monitor for any attack resumption
□ Verify reserves/holds are released on schedule
```

### Lessons Learned

Within 30 days of resolution:

```text
□ Conduct post-incident review
□ Document what worked and what didn't
□ Identify control gaps that allowed breach
□ Create action plan for improvements
□ Update incident response procedures
□ Train staff on new controls
```

### Long-Term Improvements

What to fix for next time:

| Area | Typical Improvements |
| --- | --- |
| **Detection** | Log monitoring, SIEM, intrusion detection |
| **Prevention** | Network segmentation, endpoint protection, access controls |
| **Response** | Updated playbooks, regular drills, vendor relationships |
| **Compliance** | Regular assessments, continuous compliance monitoring |

* * *

## Cost Planning Template

Use this to estimate breach costs:

```text
Breach Cost Estimate
--------------------

Investigation:
  PFI engagement:              $_________
  Internal labor (hours x rate): $_________
  External legal:              $_________

Card Brand Assessments:
  Cards exposed:               _________
  Estimated reissuance:        $_________ (applicable card count x quoted per-card amount)
  Operational costs:           $_________ (from network)

Fines:
  Non-compliance fines:        $_________
  Late notification fines:     $_________

Customer Costs:
  Customers affected:          _________
  Notification costs:          $_________
  Credit monitoring:           $_________
  Customer compensation:       $_________

Recovery:
  Remediation:                 $_________
  Re-certification:            $_________
  Increased rates:             $_________/year

TOTAL ESTIMATED COST:          $_________
```

* * *

## When to Get a Lawyer

Call a lawyer today if:

-   Personal or payment data may have been exposed
-   You operate across states or countries, so notification law gets messy
-   The attackers are demanding a ransom
-   You carry cyber insurance. The policy may name your counsel for you
-   Regulatory obligations apply, like HIPAA or SOX
-   Third-party data was caught in it
-   Litigation looks likely

* * *

## Quick Reference: Key Deadlines

| Deadline | Requirement |
| --- | --- |
| **Immediate** | Contain and preserve evidence |
| **Now** | Contact processor/acquirer and confirm who owns each notification |
| **Network-specific** | Use the notification windows and sources above; don't wait for the outer deadline |
| **Jurisdiction-specific** | Have counsel identify customer and regulator notice deadlines |
| **As directed by the brand/acquirer** | Confirm PFI engagement, report and remediation deadlines in writing |
| **Varies** | Re-certification depends on scope and the required validation |

* * *

## Emergency Contacts Template

Fill in for your organization:

| Role | Name | Phone | Email |
| --- | --- | --- | --- |
| Incident Commander |  |  |  |
| IT/Security Lead |  |  |  |
| Legal |  |  |  |
| Processor Emergency Line |  |  |  |
| Acquirer Contact |  |  |  |
| Cyber Insurance Broker |  |  |  |
| PFI (pre-selected) |  |  |  |

* * *

## Test to Run

**Breach response drill (quarterly):**

Run a tabletop exercise:

1.  **Scenario:** "We found unknown files on our payment server, and customers are reporting fraudulent charges."
2.  Walk through first 4 hours of this playbook
3.  Identify the gaps. Who didn't know their role, and what contact info was missing?
4.  Update the playbook and the contact list from what you found

**Success criteria:** Team can execute first 4 hours without confusion about roles or contacts.

* * *

## Related

-   [PCI DSS Compliance](https://paymentsandrisk.com/docs/compliance/pci-dss/) - Baseline security requirements
-   [MATCH / TMF List](https://paymentsandrisk.com/docs/chargebacks/match-tmf/) - What happens if processing is terminated
-   [Processor Management](https://paymentsandrisk.com/docs/operations/processor-management/) - Working with processors
-   [Terminal Security](https://paymentsandrisk.com/docs/fraud/terminal-security/) - Preventing POS breaches
-   [Survive a Fraud Attack](https://paymentsandrisk.com/docs/playbooks/survive-fraud-attack/) - Fraud attack response
-   [Network Programs](https://paymentsandrisk.com/docs/chargebacks/reference/network-programs/) - Brand compliance programs
-   [Money Held or Frozen](https://paymentsandrisk.com/docs/operations/holds-and-reserves/) - Cash flow during incidents