Finding out that your business has suffered a data breach is stressful. Maybe a customer list has appeared online, an email account was taken over, or your website was hacked and visitors' details were copied. Knowing what to do after a data breach, and doing it in the right order, can limit the damage, protect your customers and keep your reputation intact. This guide is written for small and medium businesses in Uganda and is organised as a timeline: the first hour, the first day, the first week and the months after.
First, what counts as a data breach?
A data breach is any event where information your business holds is accessed, copied, changed, lost or destroyed without permission. Common examples in Ugandan businesses include:
- A staff email account hacked through a fake login page, then used to send invoices with changed bank or Mobile Money details
- A website database with customer names, phone numbers and orders copied by an attacker
- A laptop with unencrypted client files stolen from a car
- Spreadsheets with staff salaries or national ID numbers shared by mistake on a WhatsApp group
- Ransomware locking the office computers and copying files before encrypting them
Not every incident is a full breach, but treat each one seriously until you know the facts.
The first hour: contain the damage
Your first job is to stop the problem getting worse. Do not panic and do not start deleting things, because you may destroy evidence you will need later.
- Disconnect affected devices from the network. Unplug the network cable or switch off Wi-Fi on infected computers. Do not switch them off completely unless advised, as some evidence lives in memory.
- Change passwords for compromised accounts. Do this from a clean device, starting with email, because email is used to reset everything else.
- Sign out all sessions. Most email and cloud services let you sign out of every device at once. Do it.
- Turn on two step verification for the affected accounts if it was not already on.
- Put your website into maintenance mode if it is the source of the breach, and contact your hosting provider.
- Tell your key people. The owner or director, your IT support and whoever handles finance should know immediately, especially if payment instructions might have been changed.
The first day: understand what happened
Once the bleeding has stopped, work out what was affected. Write everything down as you go, with dates and times. This record will help with reporting, insurance and learning from the incident.
Questions to answer
- How did you find out about the breach, and when?
- Which systems, accounts or devices were involved?
- What kind of data was exposed: names, phone numbers, ID numbers, financial records, passwords, health information?
- How many customers, staff or partners are affected?
- Is the attacker still able to get in?
Where to look
- Email account activity logs and forwarding rules. Attackers often set up hidden rules to copy or delete messages.
- Website and hosting logs, including cPanel access logs and recently changed files.
- Bank and Mobile Money statements for unusual payments.
- User lists on your website, accounting system and cloud storage for unfamiliar accounts.
If you do not have the skills in house, bring in a trusted IT professional or security firm. Your hosting provider can often help identify how a website was compromised and restore a clean copy from backup.
The first week: notify and recover
Check your legal duties
Uganda's Data Protection and Privacy Act sets out obligations for organisations that collect and process personal data, including reporting breaches to the Personal Data Protection Office, which operates under NITA-U. The law also expects you to inform affected people in appropriate cases. Requirements and procedures can change, so speak to a lawyer or check the Personal Data Protection Office guidance for exactly what you must report and how quickly. If you are in a regulated sector such as banking, insurance or telecoms, your regulator may have its own rules too.
Tell affected customers clearly
Customers would rather hear the truth from you than find out from someone else. A good notification is short and honest. It should explain:
- What happened, in plain language
- What information was involved
- What you have done so far to fix it
- What they should do now, for example change a password or ignore payment requests with new account numbers
- Who they can contact with questions, by phone and email
Send it by email, SMS or WhatsApp depending on how you normally reach them. Avoid technical jargon and avoid blaming staff or customers.
Warn about follow up scams
After a breach, criminals often use stolen details to call or message victims pretending to be your business. Tell customers that you will never ask for their PIN, password or Mobile Money codes, and give them a single official number to confirm any unusual request.
Restore systems safely
- Restore websites and files from a clean backup taken before the breach.
- Update all software, themes and plugins before going live again.
- Remove unknown user accounts and reset every admin password.
- Scan computers with up to date antivirus, or reinstall the operating system if ransomware was involved.
- Monitor closely for a few weeks in case the attacker tries to return.
The months after: prevent it happening again
Every breach teaches something. Hold a short review meeting with everyone involved and ask what went wrong, what went well and what should change. Typical improvements include:
- Two step verification on all email and admin accounts
- Staff training on phishing, fake invoices and suspicious links
- Encrypting laptops and phones that hold customer data
- Collecting less personal data in the first place, and deleting what you no longer need
- Regular, tested backups stored away from the main system
- A written incident response plan with names and phone numbers
A one page breach response checklist
- Isolate affected devices and accounts
- Change passwords and sign out all sessions
- Alert management, IT and finance
- Record what happened and when
- Identify the data and people affected
- Check legal reporting duties and notify where required
- Inform customers clearly and warn about scams
- Restore from clean backups and patch systems
- Review and improve security
Frequently asked questions
Should I pay a ransomware demand?
Paying does not guarantee you will get your files back, and it encourages further attacks. Seek professional advice, report the incident, and rely on backups wherever possible.
Do small businesses really need to report breaches?
Data protection law in Uganda applies to organisations of all sizes that handle personal data. Check your obligations rather than assuming you are too small to matter.
How can I tell if my email account was hacked?
Signs include sent messages you did not write, new forwarding rules, missing emails, password reset messages you did not request and contacts saying they received strange requests from you.
Can my hosting provider help after a website breach?
Usually yes. A good host can help review logs, restore a clean backup and point out outdated software. This is one reason to choose hosting with daily backups.
Conclusion
A data breach is serious, but it does not have to destroy your business. Contain it quickly, understand what happened, tell the right people honestly and fix the weaknesses that let it happen. Prepare a simple plan before you ever need it. If your website or email is hosted with Baasa Cloud, our local support team and daily backups are there to help you recover faster.