CRM data breach response plan: contain, assess, notify and recover

If customer data in your CRM may have been accessed by someone who should not have it, act in four steps: contain the incident (lock the account, revoke access, stop exports), assess what was exposed and whether serious harm is likely, notify where the law requires or where it is the right thing to do, and review what to fix. If your business is covered by the Privacy Act, the Notifiable Data Breaches scheme requires a reasonable and prompt assessment of a suspected eligible breach, generally within 30 days, and notification to the OAIC and affected individuals as soon as practicable if the breach is likely to result in serious harm. Write the plan before you need it; a one-page version is enough for most small businesses.

This guide is part of why CRM rollouts fail. It is general information, not legal advice. For a serious breach, get legal and technical help quickly. Before an incident, check that your contract requires the vendor to notify you promptly (see contract traps) and know which regulators to contact (see complaints, disputes and official sources).

How CRM breaches usually happen

A staff member's password is phished or reused, and the attacker logs in.
A departing employee exports the contact list before leaving.
An integration or API key is exposed, giving access to data.
A shared report or file link is sent to the wrong person or made public.
The CRM vendor, or another app connected to it, has an incident.
A laptop or phone with synced data is lost without a passcode.

Step 1: contain (first hours)

Lock the affected account and reset its password; sign out all sessions.
Enforce multi-factor authentication for every user if it is not already on.
Revoke API keys and connected apps that may be involved; re-issue only what is needed.
Check the audit log for exports, bulk downloads, permission changes and new users.
Disable public links to reports and files.
Contact the vendor's security or support team, and the provider of any connected app involved.
Preserve evidence: export logs, take screenshots, note times. Do not delete records that show what happened.

Step 2: assess (generally within 30 days, faster is better)

Work out:

Question	Examples
What data was involved?	Names, emails, phones, addresses, notes, health or financial details, identity documents
How many people?	All contacts, one segment, a few records
Who accessed it, and is it recoverable?	Known staff member who returned it, or unknown attacker
Could it cause serious harm?	Identity theft, financial loss, scams, distress, physical safety risks
Can remedial action prevent serious harm?	Retrieving a mis-sent file before it was opened

Under the Notifiable Data Breaches scheme, an eligible data breach occurs when there is unauthorised access to, disclosure of, or loss of personal information that is likely to result in serious harm to one or more individuals, and the harm cannot be prevented by remedial action. Contact details alone may carry lower risk than identity documents or health information, but a combined contact list can still fuel targeted scams; assess the specific data.

Step 3: notify

If you are covered by the Privacy Act and the breach is eligible:

prepare a statement for the OAIC (the OAIC website has an online form) describing your business and contact details, what happened, the kinds of information involved, and steps individuals should take;
notify affected individuals directly, or publish the statement if direct notice is not practicable;
do this as soon as practicable after you form the view that the breach is eligible.

If you are exempt (for example under the small business exemption), notification is not legally required under the scheme, but telling customers what happened and how to protect themselves is often the right step and can reduce harm. Remember that contracts with your customers or partners may also require notice.

Other reports to consider:

report cybercrime through ReportCyber on the Australian Cyber Security Centre's website;
if a ransomware or cyber extortion payment is made and your business has annual turnover above $3 million, the Cyber Security Act 2024 requires a report to the Australian Signals Directorate within 72 hours;
tell your insurer early if you have cyber insurance; policies often require prompt notice;
if a staff member took data, seek legal advice about recovery and employment action.

Step 4: support customers and recover

Warn customers about scams that may use the stolen data (fake invoices, impersonation calls or emails).
Give them a contact point for questions.
Point individuals to support services such as IDCARE, Australia's national identity and cyber support service, if identity information was involved.
Monitor for misuse and keep records of what you did.

Step 5: review and prevent

Control	Why
Multi-factor authentication for all users	Blocks most password-based logins
Least-privilege permissions	Fewer users can export everything
Export restrictions and alerts	Bulk exports need approval or trigger a notice
Off-boarding checklist	Remove access the day someone leaves
Review of connected apps every quarter	Remove unused integrations
Retention rule	Less old data means less to lose
Staff training on phishing	Most breaches start with a human

See integrations for reviewing connected apps and the Privacy Act guide for security obligations under APP 11.

Illustrative response timeline

Time	Action
Day 0, hour 1	Suspicious export noticed; account locked; vendor contacted
Day 0, hours 2–6	Audit log reviewed; scope estimated at 2,300 contacts with names, emails and phone numbers
Day 1	Legal and insurer contacted; preliminary harm assessment
Days 2–7	Assessment completed: likely serious harm through targeted scams; notification prepared
Day 8	OAIC statement lodged; customers emailed with scam warnings and a contact point
Weeks 2–4	Controls strengthened; staff trained; incident review documented

This example is illustrative; real timelines depend on the facts, and an assessment can and should finish faster where possible.

Penalties and other exposure

Serious or repeated interferences with privacy can attract civil penalties under the Privacy Act, and the OAIC has a tiered range of enforcement tools. Since 10 June 2025, individuals can also sue under the statutory tort for serious invasions of privacy in some circumstances, which is not limited to Privacy Act-covered businesses. Fast, honest handling reduces both harm and risk.

Frequently asked questions

The vendor had the breach. Is it my problem?

Often yes. If the data is held for your business, the obligation to assess and notify usually sits with you. Your contract should require the vendor to notify you quickly and cooperate.

Is an email sent to the wrong person a data breach?

It is an unauthorised disclosure. Whether it is an eligible data breach depends on the information and the likely harm; if the recipient deletes it promptly, remedial action may prevent serious harm.

Do we have to notify for a breach of business contact details only?

It depends on the likely harm. Assess the specific data and circumstances; when in doubt, read the OAIC's guidance or get advice.

What should our one-page plan include?

Who leads, who to call (vendor, IT help, lawyer, insurer), the containment steps above, the assessment questions and the notification contacts.

Sources

Office of the Australian Information Commissioner — Notifiable Data Breaches scheme, assessment and notification
Australian Cyber Security Centre — ReportCyber, small business guides and ransomware payment reporting
IDCARE — identity and cyber support for individuals
Federal Register of Legislation — Privacy Act 1988 and Cyber Security Act 2024