Third-Party Breach Intake

3. Has your clock started?

• You are likely the controller of the affected personal data. Your own regulator clocks may start from this notice — once you have reasonable certainty that your data was affected. Under GDPR / UK GDPR that is 72 hours.
• US state laws generally require the vendor to tell you, and you to notify affected residents within each state's limit (30 to 60 days in many states) from your discovery.

Ask Coastline Payroll Services when they became aware, to check it against your 48-hour notice term.

Work out every deadline with the Breach Notification Clock Calculator. Roles and clocks are legal questions — check with counsel.

Subject: Security incident at Coastline Payroll Services — information request from Meridian Freight Co.

Hello,

Thank you for letting us know about the security incident affecting Coastline Payroll Services (payroll processing). To meet our own obligations we need the following, in writing. Partial answers now are more useful than complete answers later — please send what you have and tell us when the rest will follow.

1. When did you first detect the incident, when did the unauthorised activity start, and when was it contained?
2. Which systems and environments were affected, and how did the attacker get in?
3. Was our data accessed, taken, or both? Please list the data fields and number of records relating to us, and the time window.
4. Is the attacker still in your environment? What have you done to contain and remove them?
5. Who is investigating (internal team or an external forensic firm)? Will you share a summary of findings or a written attestation when it is complete?
6. Have you notified law enforcement or regulators? Are you aware of the data being published, sold or misused?
7. Which indicators of compromise (IP addresses, domains, file hashes, account names) can you share so we can search our own environment?
8. Did any of your subprocessors or suppliers play a part, and does that affect our data?
9. Who is our single point of contact, and how often will you update us until this is closed?
10. Was payment or bank data encrypted or tokenised, and were keys or tokens also exposed?
11. Were government ID numbers stored in clear text, and are they among the fields accessed?
12. Could files or data you sent us have been altered? Please confirm the integrity of recent transfers.
13. Were API keys we issued to you stored in the affected systems? (We are rotating them now and will send replacements by a secure channel.)
14. Were your identity provider, SAML/OIDC signing keys or federation certificates affected? Have any changed?
15. Were any of your staff accounts that access our systems compromised? Please list the staff who currently have access.
16. Our agreement requires notice within 48 hours of your becoming aware. Please confirm the date and time you became aware.

Please treat this request and your answers as confidential. We would like a first response within 24 hours and a standing update until the incident is closed.

Kind regards,
[Name, role]
[Contact number]

1. Log when and how you learned of the breach, open an incident and name an owner.
2. Verify the notice through a contact you already hold — not through links or numbers in the notice.
3. Pull the contract and data processing agreement: notice period, cooperation, audit rights, liability.
4. Preserve your own logs that involve the vendor (sign-ins, API calls, transfers) and extend retention.
5. Warn staff, and customers if relevant, to expect phishing that uses the vendor's name or the stolen data.
6. Pause or validate the data feed; scan recent files for tampering and malware.
7. Rotate SFTP or transfer credentials.
8. Rotate the API keys you issued to the vendor: issue new, confirm they work, then revoke the old ones.
9. Search API logs for the old keys used from unusual IP addresses or at unusual volumes.
10. Review sign-ins through the vendor's federation trust over the exposure window; look for new accounts created via SSO.
11. Be ready to rotate or remove the federation certificate if the vendor's signing keys are in doubt.
12. Disable or reset vendor staff accounts and review their recent activity.