Security Incident Email Templates: Breach, Scam and All-Clear

The email you send after a security incident is read more carefully than anything else you will ever send, and it is usually written at midnight by someone who has not slept. Write it now, while nothing is wrong, and fill in the blanks when it is. The four templates below cover the incidents a small business actually has: a scammer using your name, a mailbox taken over and used to send fraud, a leak of customer data, and the all-clear. They are plain, specific and short, because that is what a frightened reader needs.

What the law expects

In the EU and the UK, a breach of personal data must be reported to the data protection authority within 72 hours of becoming aware of it, unless it is unlikely to risk people's rights, and affected people must be told without undue delay when the risk to them is high. Most US states have their own breach notification laws with their own deadlines, and many other countries have similar rules. The templates below do not replace that reporting; they are the customer-facing part. Have one address, privacy@ or security@, that handles the follow-up, set up as described in the privacy address guide, and know who you would call for legal advice before you need to.

Rules for every incident email

• Say what happened in the first two sentences, in plain words. "Someone gained access to our bookings mailbox on Tuesday" is better than "we recently became aware of a security event".
• Say what information was involved and what was not. Readers want to know if their card number was in it.
• Say what you have done, what they should do, and who to contact. Three short lists.
• Send from a named person, from a real mailbox, with no links that ask them to log in anywhere. After an incident, your customers will rightly be suspicious of links from you.
• One recipient per email, or Bcc. An incident email with the customer list visible is a second incident.

1. A scam is using your name

Subject: Warning: fake emails pretending to be [Company]

Hi [First name],

We have learned that someone is sending emails that pretend to come from [Company], asking people to [pay an invoice to new bank details / click a link / confirm a password]. These emails are not from us.

What to check: our real emails only ever come from addresses ending in @[yourdomain.com]. We never change our bank details by email, and we never ask for your password.

If you received one of these, please do not act on it. Forward it to security@[yourdomain.com] and then delete it. If you already paid or entered details, contact your bank now and then call us on [phone].

We are sorry for the worry this causes. We have reported it and are watching for more.

[Name]
[Role], [Company]
[Phone]

2. A mailbox was taken over and used

Subject: Important: an email sent from our account on [date] was not from us

Hi [First name],

On [date], someone gained access to our [bookings@ / a colleague's] mailbox and sent an email from it to some of our contacts. If you received an email from [address] on [date] about [subject or topic], it was sent by the intruder, not by us. Please delete it and do not open its attachment or follow its link.

We have since locked the mailbox, changed every password, turned on two-step sign-in across the company and reviewed what the intruder could see. The mailbox contained [a plain description: names and email addresses of people we have written to; no card details or passwords].

If you clicked the link or opened the attachment, please change any password you entered and run a security scan. If you are unsure, reply to this email or call [phone] and we will help.

I am sorry this happened. [One sentence on what changes, only if true.]

[Name]
[Role], [Company]

3. Customer data was exposed

Subject: Notice of a data incident affecting your [account / order] with [Company]

Hi [First name],

I am writing to tell you about a security incident that involved some of your information.

What happened: on [date], [plain description: a mailbox was accessed without permission / a file was sent to the wrong recipient / a system was broken into]. We found out on [date] and stopped it on [date].

What was involved: [the specific data: your name, email address and the dates of your appointments]. It did not include [what it did not include: card numbers, passwords, identity documents].

What we have done: [secured the account / reported it to the regulator on date / notified the police / engaged a specialist].

What you can do: [be alert to emails or calls claiming to be from us; change your password if you used the same one elsewhere; watch statements]. We will never ask you for a password or payment details by email.

If you have questions, email privacy@[yourdomain.com] or call [phone]; [Name] is handling this personally.

I am sorry. You trusted us with your information and we did not protect it as we should have.

[Name]
Owner, [Company]

4. The all-clear

Subject: Update on the security incident of [date]

Hi [First name],

An update on the incident we told you about on [date].

We have completed our review with [a specialist / our IT provider]. [Plain summary: the access was limited to the one mailbox; no further information was taken; the fake emails have stopped.]

What has changed: [two-step sign-in on every account; a new policy of confirming bank details by phone; a yearly security review].

Nothing further is needed from you. If anything about it still concerns you, reply to this email and I will answer personally.

Thank you for your patience.

[Name]
[Role], [Company]

Before you need these

• Turn on two-factor authentication for every mailbox today; the 2FA guide takes ten minutes and prevents the incident behind template 2.
• Decide who can send an incident email and who signs it. The owner signs template 3; a manager can sign the rest.
• Keep an export of your customer contact list somewhere other than the mailbox that might be the one compromised.
• Put the yearly check in the calendar; the security audit checklist is an hour, and the shared mailbox guide covers the addresses most often taken over.

Common questions

Should we tell customers at all if the data was minor?

If the law requires it, yes. If it does not, consider what they would think on finding out later from someone else. A short, honest template 1 or 2 almost always costs less than silence discovered.

Can we send this from a no-reply address?

No. The one thing an incident email must do is let a worried person reach you. Send it from a named person's mailbox, and staff that mailbox for the next few days.

What if the regulator deadline passes before we know the details?

Report what you know within the deadline and update it; regulators expect that. The customer email can wait a day for accuracy; the regulatory report usually cannot.