What to do when your cloud provider is breached, from a former cyber insurance adjuster: If your provider just disclosed a breach, you have to assume you've been exposed. And every instinct you have about what to do next is probably wrong. So here's what you should actually do: When you first hear about the hack, even if you doubt you were exposed, you need to get on it. Right away. I don't care if you're on a date, or at your son's college graduation. Get to a computer and start rotating every secret…everything. When someone asks later how fast you responded, you want the answer to be "immediately," with timestamps to prove it. You're going to want to put as little in writing as possible. I get the instinct. Do the opposite. Document everything, obsessively. If your provider has locked things down and you can't rotate something yet, write that down too, with the time you tried. If you're using agents to investigate (and you should be, spread wide across everything), keep every trace and make them write down everything they find. This will feel wrong in your soul. Do it anyway. If this ever turns into a claim, if you can show you did everything you were supposed to, minute by minute, you will survive. You might tell yourself it's just names and emails and nobody cares. But this is wrong. All customer data counts. I've watched companies lose millions just because someone could see data they shouldn't have. You're going to want to wait for your provider to finish investigating before communicating with your own customers. Don't. Figure out what information may have been exposed, even if you’re not sure yet who it belongs to, and what obligations you have under your contracts / applicable law. Your cloud provider’s investigation doesn’t change the fact that you have your own obligations to meet. And learning about a deadline after you’ve missed it is a very expensive lesson. Bookmark this. I hope you never need it, but with everything happening lately, there's a real chance you will.