Build a 72-Hour Breach Detection Program That Actually Works

Your security team just spotted suspicious activity in your network logs. You've got 72 hours before you're legally required to report it under most breach notification rules. But here's the problem: you don't know yet if it's actually a breach, what data was accessed, or who's affected. That investigation gap is where breach response programs collapse.

Two recent healthcare incidents illustrate this challenge. Community Health Center of Buffalo detected suspicious activity on April 21, 2026, and confirmed unauthorized access occurred between April 20 and 21. Greenbaum Rowe Smith & Davis, a law firm handling patient data for Atlantic Health System and other healthcare providers, notified 12,801 individuals after discovering unauthorized system access. Both organizations are still reviewing files to determine the full scope.

The recurring pattern: detection happens quickly, but investigation drags on for weeks. You need a program that closes that gap.

Essential Preparations

Technical requirements:

• SIEM or log aggregation platform with at least 90 days of retention
• Endpoint Detection and Response (EDR) tools deployed across all workstations and servers
• Network traffic capture capability (full packet capture for critical segments, metadata for everything else)
• File integrity monitoring on systems storing regulated data
• Database activity monitoring for applications containing HIPAA, GLBA, or other sensitive records

Documentation and access:

• Current data inventory mapping what systems contain what data types (names, SSNs, medical records, financial data)
• Role-Based Access Control matrix showing who should access what
• Incident response runbook with escalation tree and notification templates
• Pre-negotiated contracts with digital forensics firms (don't wait until you need them)
• Legal review of breach notification obligations under applicable regulations (HIPAA, General Data Protection Regulation, state laws)

Team roles:

• Incident commander (decides when to escalate and invoke formal response)
• Technical lead (runs forensic investigation)
• Legal/compliance contact (determines notification requirements)
• Communications lead (drafts notifications, coordinates with PR if needed)

Step-by-Step Implementation

Phase 1: Configure Detection Triggers

Set up automated alerts that flag potential unauthorized access:

In your SIEM, create rules for:

• Failed authentication attempts from a single account exceeding 10 in 5 minutes
• Successful login from an IP address not seen in past 30 days for privileged accounts
• Access to file shares containing "SSN", "medical", "patient" outside business hours
• Database queries returning more than 1,000 records by non-service accounts
• Privilege escalation events (user added to admin groups)

Configure EDR to alert on:

• Process execution from temp directories or user profile folders
• Credential dumping tools (mimikatz, procdump, lsass access)
• Lateral movement indicators (PsExec, WMI remote execution, remote desktop from workstations)
• Data staging (large file compression, unusual network transfers)

Aim for an 80% signal-to-noise ratio where your team can triage 5 alerts per day without alert fatigue.

Phase 2: Build the Investigation Workflow

When an alert fires, your technical lead follows this sequence:

Hour 0-2: Initial triage

1. Pull authentication logs for the affected account or system for past 7 days
2. Check if the activity matches known patterns (scheduled job, legitimate admin work, user traveling)
3. If suspicious, immediately preserve logs and create forensic snapshots of affected systems
4. Document timeline: first suspicious activity, last observed activity, systems touched

Hour 2-8: Scope determination

1. Identify all systems the attacker accessed using network flow data and authentication logs
2. For each system, pull file access logs showing what directories or databases were opened
3. Cross-reference accessed locations against your data inventory to determine what data types were exposed
4. If you find evidence of data exfiltration (large outbound transfers, cloud storage uploads), treat it as confirmed breach

Hour 8-24: Impact assessment

1. For each data type exposed, list the individuals affected (query databases, parse file metadata)
2. Calculate affected individual count per jurisdiction (you'll need this for notification decisions)
3. Engage legal counsel to determine if the access meets the legal threshold for "breach" under applicable regulations
4. Document: what data was accessed, how many individuals, what the attacker did with it

Phase 3: Evidence Collection

While investigating, collect forensic evidence that will survive legal scrutiny:

For each affected system:

• Create disk image before making any changes (use write-blockers or forensic boot media)
• Export authentication logs, application logs, and database transaction logs
• Capture memory dumps from running systems if attacker may still be present
• Screenshot any suspicious processes or open network connections
• Document chain of custody (who collected what, when, hash values of all evidence files)

Store evidence on air-gapped storage or offline media. Assume you'll need to provide it to regulators or use it in litigation.

Phase 4: Notification Decision Point

By hour 24, you need to decide: is this a reportable breach?

HIPAA breach threshold: Does the incident involve unauthorized access to protected health information? If yes, it's presumed a breach unless you can demonstrate low probability of compromise. You can't meet that standard if you don't know what the attacker did with the data.

General Data Protection Regulation threshold: Does the breach pose a risk to individuals' rights and freedoms? Personal data accessed by unauthorized party typically meets this standard. You have 72 hours from awareness to notify supervisory authority.

State law thresholds: Most US state laws require notification if unencrypted personal information (name + SSN, driver's license, or financial account) was accessed by unauthorized person.

If you're at hour 24 and still investigating, you're approaching notification deadlines. Engage your legal team now.

Validation: How to Verify It Works

Run a tabletop exercise quarterly:

Scenario: "EDR alerts on credential dumping tool execution on workstation in billing department. Go."

Your team should be able to:

• Pull relevant logs within 15 minutes
• Identify what systems the workstation can access within 30 minutes
• Determine what data types are at risk within 1 hour
• Produce draft timeline and affected individual count within 4 hours

If you can't hit these benchmarks in a drill, you won't hit them during a real incident.

Technical validation:

• Verify your SIEM retains 90 days of logs by querying for events from 89 days ago
• Test EDR response by running harmless versions of attack tools (use Atomic Red Team tests)
• Confirm file integrity monitoring detects changes by modifying a monitored file
• Validate database activity monitoring by running a query that should trigger an alert

Maintenance and Ongoing Tasks

Weekly:

• Review detection rule performance (alert volume, false positive rate)
• Update data inventory when new systems or databases are deployed

Monthly:

• Test incident response communication tree (can you reach all team members in 30 minutes?)
• Review and update notification templates based on new regulatory guidance

Quarterly:

• Tabletop exercise with different scenario
• Audit privileged account usage to identify anomalies before attackers exploit them
• Review contracts with forensics firms and legal counsel

Annually:

• Full-scale breach simulation including legal and PR teams
• Update incident response runbook based on lessons learned
• Retrain team on evidence collection and chain of custody procedures

The goal isn't to prevent every breach. It's to detect unauthorized access within hours, complete investigation within days, and meet notification deadlines without scrambling. When your detection program works, you'll know because your incident commander can answer three questions at hour 24: what data was accessed, how many individuals are affected, and what notification obligations apply.