But courts want to see businesses respond in a proactive and forthright manner, whether investigating the breach, notifying authorities, or alerting customers and extending identity theft protection.
Any data breach response plan would include an internal forensic investigation to identify exactly which records had been exposed, and how, not least to strengthen future information security defenses.