Executive Incident Response Guide

72-Hour Breach Lockdown Checklist

Actionable steps in exact order of priority following credential theft or identity compromise. Stop account takeovers before scrubbing data broker records.

Lockdown Completion Status 0% (0 / 8 steps)

Automate Data Broker Removal ↗

🚨 Phase 1: Hours 0–2 · Emergency Perimeter Containment

1. Lock Down Mobile Carrier (SIM Swap Protection)

Call AT&T, Verizon, or T-Mobile to enable a verbal Port-Freeze PIN and SIM Protection Lock.

2. Execute Direct Credit Freeze at All 3 Bureaus

Freeze credit files at Experian, TransUnion, and Equifax. Do not use temporary "credit locks" — use legal freezes.

🔑 Phase 2: Hours 2–12 · Credentials & Session Termination

3. Terminate All Active Web & App Sessions

Log into primary Google/Apple/Microsoft accounts and click "Sign out of all other sessions" to invalidate stolen session cookies.

4. Upgrade 2FA from SMS to FIDO2 Hardware Passkeys

Remove SMS phone verification. Switch to hardware YubiKeys or device passkeys on email and password managers.

🛡️ Phase 3: Hours 12–24 · Financial Backdoor Audit

5. Audit Secondary Recovery Emails & Forwarding Rules

Check Gmail/Outlook filter rules for silent forwarding or hidden recovery email addresses inserted by attackers.

6. Place ChexSystems Bank Account Freeze

Freeze ChexSystems and Early Warning Services (EWS) to prevent unauthorized checking and savings accounts from opening in your name.

🐕 Phase 4: Hours 24–72 · Data Broker Scrubbing

7. De-Index Public Dossiers from Tier-1 People Search Engines

Submit automated opt-out packets to Whitepages, LexisNexis, Spokeo, Radaris, and FastPeopleSearch via Privacy Dawg.

8. Deploy Ongoing Monitoring & Re-Listing Defense

Enable continuous automated scanning across 2,400+ data brokers to prevent re-scraping from public court and property records.