Your host, your payment processor, a customer or a security plugin has just told you that customer data may have been exposed. Your stomach drops, and the first question is the practical one: what do I have to tell customers, and how fast?
Start with the store, not the notice. Lock down the accounts and systems involved and keep every log and alert, because you cannot write an accurate message about a breach you have not contained or measured.
Then work out whose data was involved and which rules apply to a small online store: state law for U.S. customers, GDPR for customers in the EU, and your payment processor's rules if card data is in play. The notice comes after that, and it can be short, plain and calm.
Key Takeaways
Secure the store, change credentials, and preserve logs before you send anything. The FTC's order puts containment ahead of notification.
Customer-notice rules are mainly state laws, and they differ on triggers, data covered and timing. Check the law for each affected customer's state.
Under GDPR, the 72-hour clock runs to the supervisory authority. Telling individuals is tied to a high-risk test, with no universal 72-hour deadline.
Contact your processor and acquiring bank right away, because a card brand or acquirer may require a PCI-approved forensic investigator.
A good notice names the data, the dates, what you did, what customers should do, and how updates will arrive.
Secure the store and preserve evidence before anything else
The FTC's Data Breach Response guide for business begins with containment. Secure operations, change compromised credentials, remove exposed information from where it should not be, and document what you find. Do not wipe logs or rebuild the server yet. Those records tell you how the attacker got in, and a lawyer or forensic investigator will want them.
Changing one password is rarely enough. Rotate admin logins, API keys, database credentials, email accounts and the recovery methods on each, and turn on multifactor authentication. A reused password on a store admin account, or a compromised business email account, can give an attacker the same access again.
Start a written timeline now. Note when you found the problem, who found it, which systems are involved, what your host or platform told you, which credentials you changed, and who you have contacted. You will reuse this record for the notice, for your lawyer, and for your processor.
If you are still working out what happened to the site itself, the steps in what to do in the first 24 hours after a website hack cover the technical cleanup.
A ten-minute inventory tells you whose data is involved
You cannot tell customers what was exposed until you know what you hold and where. Open a blank sheet and list every place customer data lives. Mark each one as confirmed exposed, possibly exposed, not involved, or unknown.
| Place to check | What may be sitting there |
|---|---|
| Store platform and database | Names, emails, phone numbers, shipping and billing addresses, order history, account passwords |
| Payment flow | Hosted checkout, stored payment tokens, refunds, payment exports |
| Plugins and add-ons | Forms, review tools, chat widgets, shipping, subscription and abandoned-cart tools |
| Hosting and backups | Database server, backups, logs, staging copies, file storage |
| Email and text tools | Newsletter lists, order-confirmation service, support inbox, exported lists |
| Staff, agencies and vendors | Admin accounts, freelancer logins, fulfillment and help-desk tools |
| Spreadsheets and downloads | CSV exports, shared drives, laptops, old backups |
Also note where your customers live: which states, whether any are in the EU or European Economic Area, and whether anyone falls into a category that carries extra rules, such as health data or children's data. That one list drives most of the legal questions in the next section.
Precise words matter here. A suspicious login does not prove data was taken, and unauthorized access does not prove every record was copied. If the supported fact is that data "may have been accessed," write that, not "stolen."
Your state's law, and GDPR if you sell to the EU, set the clock
In the United States, customer notification is mainly a matter of state law. The National Conference of State Legislatures keeps a comparison of security breach notification laws, updated December 15, 2025, covering all 50 states, the District of Columbia and several territories. It is a starting point, not legal advice. The triggers, the data covered, the number of affected people that triggers a regulator notice, and the timing all differ.
The usual rule is notice without unreasonable delay, or within a set number of days, after you learn of the breach, with room for a law-enforcement request to hold off. California, for example, generally requires notice "in the most expedient time possible and without unreasonable delay," with required content set out in Civil Code section 1798.82, as the California Attorney General's privacy page points to.
So, check the law for each affected customer's state, not only your own. A store in Ohio with a customer in California owes that customer California's version.
For customers in the EU or European Economic Area, GDPR adds two separate duties. Article 33 generally requires you to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach, unless the breach is unlikely to risk people's rights and freedoms. Article 34 requires telling the individuals directly, without undue delay, when the breach is likely to result in a high risk to them.
That is why the "72-hour rule" is only half true for a store. The 72 hours is the regulator deadline. Customer notice follows a high-risk test and has no universal 72-hour clock.
| Who | What sets the timing | Where to check |
|---|---|---|
| U.S. customers | The law of each customer's state; often "without unreasonable delay" or a set number of days | Your state attorney general and the NCSL comparison |
| EU or EEA regulator | Without undue delay, and where feasible within 72 hours, unless risk is unlikely | GDPR Article 33 |
| EU or EEA customers | Without undue delay when the breach is likely to create a high risk | GDPR Article 34 |
| Payment processor and acquirer | The incident channels and deadlines in your merchant agreement | Your processor contract |
Call a lawyer when the facts or the rules are not simple
General information like this is not legal advice. A lawyer who handles privacy or data security should look at your incident early, and before you send the notice, when any of these is true:
- Payment-card data, health data, government ID numbers or children's data may be involved.
- Customers are spread across several states or countries.
- A large number of people are affected, or you cannot tell how many.
- You are unsure whether notice is required at all.
Counsel can decide which laws are triggered, whether a law-enforcement delay applies, and how to word the notice. Your technical records, which you are already keeping, make that conversation faster and cheaper.
Card data means calling your processor and acquirer right away
If payment-card information may be involved, contact your payment processor and your acquiring bank through the incident channels in your merchant agreement. Do not assume that using Shopify or Stripe takes the duty off you. Shopify's privacy and security help pages and Stripe's terms describe what each platform handles, and what is yours depends on your contract, your account setup and where the exposed data was stored.
The PCI Security Standards Council's guidance on responding to a cardholder data breach says merchants should be ready to alert payment brands, acquirers and anyone else who requires notice by contract or law. If cardholder data was breached or is suspected to be, a payment brand or acquirer may require an independent investigation by a PCI-approved forensic investigator.
Stripe's terms carry their own duties too. Its service terms call for immediate notice of unauthorized access to certain data covered by the security addendum, and its Apps Agreement uses a 72-hour outer limit for certain app-related breaches. Those are obligations to Stripe, not a deadline for telling customers.
Say in your customer notice whether card information was involved only when the facts support it. If it may have been, tell customers what is known or suspected and point them to their card issuer or your processor's instructions.
The FTC lists what a customer notice has to contain
The FTC tells businesses to describe in plain language what happened, what information was involved, what the business has done about it, what customers should do, how to get help, and how future updates will be delivered. It also says not to overstate the facts or hide details that would help customers protect themselves, and it suggests using more than one channel, such as a letter or email plus a page on your website and a phone number where that makes sense.
The notice should sound like you and read like a person wrote it. The FTC's small business cybersecurity guidance warns that breach messages should not look like phishing, so avoid urgent threats and unexplained links. Point customers to your own site rather than asking them to click through.
This starting point you can adapt covers each item. Fill in only what you have confirmed, and have a lawyer review it, since state laws can require specific content.
> Subject: A notice about your information at [Store Name] > > Dear [Customer name], > > On [date], we learned that an unauthorized person may have gained access to [system or tool]. We secured the affected systems on [date] and are investigating with [outside experts, if true].
> The information involved may include your [name, email address, shipping address, order history]. [We have no evidence that payment card details were involved] OR [Payment card information may have been involved.] Only state the version your investigation supports.
> What we have done: [changed passwords and access, notified our payment processor and law enforcement, as applicable].
> What you can do: [change your password, especially if you reused it elsewhere; watch your accounts and card statements; be careful with unexpected emails, texts or calls that mention your order]. We will never ask for your password or card number by email.
> Questions: contact us at [phone and email on our website]. We will post updates at [your own web page address] and email you directly if there is more you need to do.
Send it from an address customers already know, and put the same text on a page of your own site so they can check it is real.
Waiting for every answer is a worse plan than saying what you know
A store owner often feels the notice cannot go out until the investigation is finished. The FTC's approach is to communicate promptly with accurate information, while separating what is confirmed from what is still under investigation, and to tell customers what to do in the meantime. Do not delay protective steps, or a notice a law requires, while you wait for the last detail.
Avoid claims you cannot support. "No data was taken" is a technical claim, and if it turns out wrong it damages trust more than a careful "we have not yet confirmed whether" ever would. Use "may have been accessed" for the unknowns and update the page as facts firm up.
ASOS shows how a notice can separate facts, action and what comes next
On October 6, 2026, ASOS published a security incident update for customers. It describes an unauthorized party who impersonated a trusted contact to get an employee's login credentials and then used them to reach information on certain third-party platforms. ASOS says it locked down the affected platforms immediately, began an investigation with internal and external experts, and contacted law enforcement and regulators.
The notice then sorts its message by what the reader needs. The attacker had access to some personal information, including names and contact details. ASOS separately states that no payment-card information and no account passwords were accessed. It says its website and app remain safe to use, customers do not need to take account action, and they should be cautious of unexpected messages or calls. It adds that it will contact customers directly if more action or support is needed.
You can borrow that order: what happened, what data, what is safe, what to do, and how you will follow up. A small store has fewer systems and fewer customers, but the structure works the same way. Your own notice should state only what your records back up.
Where help from outside is worth it, and where it is not
An owner can start this response alone. The inventory, the credential changes, the evidence preservation and the vendor calls are all things you can do today. Outside help starts to pay off when you cannot tell what happened, you do not trust your logs, the store runs on many plugins or vendors, card data may be involved, or customers sit in several jurisdictions.
A technical review can find the access path, the exposed data locations, weak credentials, vulnerable plugins and missing logs, and it gives your lawyer and processor written records to work from. A website security audit does that technical work. It does not decide whether you must notify anyone, and it is not the PCI-approved forensic investigation that a card brand or acquirer may require.
If the breach exposed how your store was built, the rebuild matters too. A store with fewer third-party parts has fewer places to leave open, which is part of the thinking behind custom e-commerce development on Stripe.
Do you know what to do after a store data breach?
Pick an answer to begin.
1. A security plugin alerts you that customer emails may have been exposed. What comes first?
2. What does the 72-hour figure in GDPR Article 33 apply to?
3. Card data may have been exposed. Who do you contact right away?
Frequently Asked Questions About small online store data breach how to notify customers
Do I have to notify customers after an online store breach?
Possibly. It depends on the data involved, where the affected customers live, the risk to them and the law that applies. Check the state law for each affected customer and talk to a lawyer when you are unsure.
How long do I have to notify customers of a data breach?
There is no single U.S. deadline. State laws usually say without unreasonable delay or within a set number of days, and some allow a hold at the request of law enforcement. Use the NCSL comparison and your state attorney general's page to check each state.
Who should I notify first after a breach?
Contain the problem and preserve evidence first. Then contact your host or platform, your payment processor and acquiring bank if card data may be involved, law enforcement, and a lawyer, in line with the FTC's order of steps. Customer notice follows once you know whose data was involved.
Does the GDPR 72-hour rule apply to my small store?
If you sell to customers in the EU or EEA, Article 33 can require notice to the supervisory authority within 72 hours where feasible. Notice to individuals follows a separate high-risk test under Article 34.
Should I send the notice before the investigation is finished?
Do not hold back protective steps or a legally required notice while waiting for every fact. Say what is confirmed, say what is still being checked, and update customers as you learn more.
Should I offer credit monitoring?
The FTC suggests considering at least one year of credit monitoring or other identity-protection support, especially when financial information or Social Security numbers were exposed. What fits depends on the data and the rules that apply to you.
What This Means for You
Handle a store data breach in a set order. Secure the accounts, keep the logs, list the customer data you hold, check the law for each affected customer, call your processor if card data is involved, and bring in a lawyer when the facts or the rules are not simple. Then send a notice that is plain, accurate and specific about what customers should do.
You do not have to get everything perfect before you speak up. You do have to avoid saying anything you cannot back up. A clear notice that separates confirmed facts from open questions, with a way to reach you and a promise of updates you keep, protects customers and your reputation better than silence or reassurance.
If you want a second set of eyes on the technical side, Web Leveling runs a website security audit that finds the weak spots and ranks them, so you and your lawyer have documented facts to work from. We work with small and medium businesses across the country and overseas, and you can reach us through our contact page to talk through what your store needs.
Terms
Data breach words in this post
Tap a term to see what it means.
Personal data breach. A security incident that leads to the loss, alteration, unauthorized disclosure of or access to personal data.
Supervisory authority. The government body that enforces GDPR in an EU or EEA country.
Acquirer. The bank that lets a merchant accept card payments.
PCI forensic investigator. An investigator approved by the PCI Security Standards Council to examine a suspected card-data breach.
Controller. Under GDPR, the business that decides how and why personal data is used.
Multifactor authentication. A login that needs a second proof of identity beyond the password.
