<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-breach-investigation
description: >-
  Investigate data breaches through timeline reconstruction, scope analysis,
  data exposure assessment, evidence preservation, regulatory notification
  determination, and after-action reporting aligned with NIST IR and GDPR
  Art. 33 notification requirements.
domain: cybersecurity
subdomain: data-security
tags:
  - data-breach
  - incident-response
  - forensics
  - gdpr-notification
  - timeline-analysis
  - evidence-preservation
  - regulatory-compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Performing Data Breach Investigation

## Overview

Data breach investigation determines what data was accessed or exfiltrated,
how the breach occurred, its scope and impact, and notification obligations.
The investigation must preserve evidence for legal proceedings while racing
against regulatory notification deadlines (GDPR 72 hours, HIPAA 60 days,
state breach laws vary). This skill covers timeline reconstruction, scope
assessment, data exposure analysis, evidence chain of custody, and regulatory
notification determination.

Mode: `[MODE: INCIDENT]` — Breach investigation and response.

## Prerequisites

- Incident response plan with breach investigation procedures
- Access to security logs (SIEM, database audit, access logs, network)
- Forensic imaging tools for evidence preservation
- Legal counsel for notification determination
- Regulatory notification templates and contact information

## Key Concepts

### Investigation Framework

| Phase | Objective | Timeframe |
|-------|-----------|-----------|
| Detection | Confirm breach occurrence | 0-4 hours |
| Scoping | Determine data types and volume affected | 4-24 hours |
| Containment | Stop ongoing exfiltration | Immediate |
| Evidence preservation | Forensic imaging, log collection | 0-48 hours |
| Timeline reconstruction | Build chronological attack narrative | 24-72 hours |
| Notification assessment | Determine regulatory obligations | Within 72 hours |
| Remediation | Patch entry vector, revoke access | Post-containment |
| After-action | Lessons learned, control improvements | Post-incident |

### Breach Scope Assessment

```
Scope determination checklist:
├── Data types exposed
│   ├── PII: Names, SSN, DOB, addresses
│   ├── PHI: Medical records, health data
│   ├── PCI: Payment card data
│   ├── Credentials: Passwords, API keys
│   └── Business: Trade secrets, financials
├── Volume assessment
│   ├── Number of records accessed/exfiltrated
│   ├── Number of individuals affected
│   ├── Date range of exposed data
│   └── Geographic scope of affected individuals
├── Access vector
│   ├── How was data accessed (SQLi, compromised creds, insider)
│   ├── Duration of unauthorized access
│   ├── Evidence of data exfiltration vs. access only
│   └── Lateral movement from initial compromise
└── Notification triggers
    ├── GDPR Art. 33: 72-hour DPA notification
    ├── HIPAA: 60-day notification to HHS
    ├── PCI DSS: Notification to acquirer/card brands
    ├── State laws: Varies by jurisdiction and data type
    └── Contractual: Customer notification per agreements
```

### Investigation CLI

```bash
# Analyze logs for breach timeline
node scripts/agent.js --action timeline --input /var/log/access.log \
  --start "2025-03-01" --end "2025-03-15" --output /tmp/breach_timeline.json

# Assess breach scope from findings
node scripts/agent.js --action scope --input /tmp/breach_timeline.json \
  --output /tmp/breach_scope.json

# Determine notification obligations
node scripts/agent.js --action notify --input /tmp/breach_scope.json \
  --jurisdictions "eu,us-ca,us-ny" --output /tmp/notifications.json
```

## Workflow

### Step 1: Preserve Evidence

Collect forensic images before any remediation. Document chain of custody.

### Step 2: Reconstruct Timeline

```bash
node scripts/agent.js --action timeline --input /var/log/access.log \
  --start "2025-03-01" --end "2025-03-15"
```

### Step 3: Assess Scope

```bash
node scripts/agent.js --action scope --input /tmp/breach_timeline.json
```

### Step 4: Determine Notification Obligations

```bash
node scripts/agent.js --action notify --input /tmp/breach_scope.json \
  --jurisdictions "eu,us-ca"
```

## Detection

```yaml
title: Data Breach Investigation Detection
id: 15f239f6-82d7-423d-9f9a-31640b16f830
status: experimental
description: Detects suspicious activity related to performing data breach investigation techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] Evidence preserved with documented chain of custody
- [ ] Timeline reconstructed with corroborating log sources
- [ ] Data types and record counts determined
- [ ] Number of affected individuals identified
- [ ] Notification obligations assessed per jurisdiction
- [ ] Regulatory notifications filed within required timeframes
- [ ] After-action report completed with remediation plan
- [ ] Detection gap analysis identifies monitoring improvements

## References

- [GDPR Article 33 — Notification to Supervisory Authority](https://gdpr-info.eu/art-33-gdpr/)
- [NIST SP 800-61 Rev. 2 — Computer Security Incident Handling](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [HIPAA Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/)
- [MITRE ATT&CK — Collection (TA0009)](https://attack.mitre.org/tactics/TA0009/)
