Merchant incident-response guidance
What should a merchant do after a suspected data breach?
A merchant that suspects a data breach should activate its incident-response plan, involve qualified security leadership, contain affected systems without destroying evidence, document what is known, and contact relevant payment and professional advisers through verified channels.
A suspicious alert is not always proof that data was exposed, but it deserves prompt, organized investigation. The immediate goal is to limit further harm while preserving the information specialists need to determine what happened.
Immediate action
Activate the response team and protect operations
Escalate the suspected incident to the person responsible for security and business continuity. Bring together the roles needed for the situation, which may include information technology, operations, management, communications, a qualified forensic specialist, the payment provider or acquiring institution, and legal counsel. Use known contact details rather than links or phone numbers supplied by a suspicious message.
Containment should be coordinated with people who understand the affected environment. Isolating a device or network segment may reduce further access, but improvised shutdowns, reboots, software installation, or cleanup can alter volatile information and make the investigation harder. The FTC advises taking affected equipment offline without turning it off until forensic experts advise otherwise, while CISA guidance emphasizes balancing containment with evidence preservation and operational impact.
Evidence and scope
Preserve facts before changing the environment
A reliable timeline helps specialists separate a false alarm from an actual compromise.
Record what triggered concern
Note when the issue was discovered, who observed it, which system or account was involved, and what behavior appeared unusual. Preserve original alerts, relevant log locations, transaction references, and the names of people notified without copying full payment credentials.
Limit uncoordinated changes
Do not erase files, clear logs, factory-reset devices, or reinstall software merely to make the symptom disappear. NIST treats detection, response, and recovery as connected risk-management activities; evidence-informed decisions support all three.
Track every response action
Maintain a time-stamped record of containment steps, access changes, calls, decisions, and system status. The log should identify responsible people and non-sensitive references, not reproduce exposed data.
Payment contacts
Notify the right payment partners through verified routes
If payment systems or transaction information may be involved, promptly contact the merchant account provider, processor, gateway, acquiring institution, or other responsible payment partner using its authenticated portal, official statement contact, or verified website. Explain that a compromise is suspected and ask for the provider's current incident-reporting path. Do not assume that ordinary customer support, a device reseller, or a card brand replaces the party responsible for the merchant account.
Requirements and contacts are not universal. They can vary by provider, acquiring institution, card brand, technology, affected data, and jurisdiction. For example, Visa's public merchant guidance directs merchants that suspect compromise to preserve logs, notify their internal response team, and notify their acquirer. Follow the instructions applicable to the actual payment relationship rather than copying deadlines or procedures from an unrelated provider.
For preparation guidance, review what an incident-response plan for card data covers and the broader fraud prevention and security FAQ.
Investigation
Determine what happened before declaring the scope
Qualified responders can examine affected devices, access records, network activity, provider reports, backups, and account changes to identify the likely entry point and the systems or data involved. The FTC recommends working with forensic experts to determine the source and scope, reviewing who had access, and verifying whether remediation actually fixed the weakness.
Keep internal and public statements factual. Separate confirmed findings from working assumptions, update the timeline when new evidence appears, and designate one responsible communications lead. Avoid claiming that no data was exposed, that the event is fully contained, or that customers are unaffected until the investigation supports that conclusion.
Notification duties depend on the facts and applicable rules. Ask qualified legal counsel and the relevant authorities or contractual partners to determine who must be contacted, what must be communicated, and when. This page provides operational guidance, not a legal determination.
Recovery
Restore service from a known, reviewed state
Remove the cause
Address identified weaknesses, unauthorized access, malicious changes, and unnecessary privileges under the incident team's direction. Rotate credentials and secrets from a known-clean system when specialists determine it is appropriate.
Validate before reconnecting
Confirm that restored devices, software, network paths, and payment workflows have been reviewed before returning them to service. Monitor closely for repeated indicators or unexpected account and transaction activity.
Learn from the event
After stabilization, document the cause, response effectiveness, operational impact, and changes needed. Update contact lists, access controls, logging, backups, staff training, and the response plan while the lessons remain clear.
Related preventive guidance includes safer API key storage and virtual terminal security practices.
Practical questions
Common first-response questions
Should a merchant turn off a suspected device?
Do not improvise. Turning off or rebooting a device can destroy volatile evidence. Escalate promptly and follow the containment direction of qualified responders who understand the system and operational risk.
Who should be contacted about a payment-data incident?
Contact internal security leadership and the responsible merchant account or payment provider through a verified route. Provider, acquirer, card-brand, law-enforcement, and legal steps depend on the facts and applicable instructions.
When can payment operations resume?
Resume affected services only after the responsible incident team has reviewed containment and recovery, validated the environment, and established monitoring. The right timing depends on the system, evidence, and business impact.
Response checklist
Keep the first decision path simple
- Escalate the suspicion to the designated internal owner.
- Bring in qualified security and forensic help appropriate to the incident.
- Coordinate containment without erasing logs or volatile evidence.
- Document the timeline, affected assets, decisions, and verified contacts.
- Notify the responsible payment partner through its official channel when payment systems may be involved.
- Let qualified counsel determine any notification obligations.
- Restore from a reviewed state, monitor, and update the response plan.
Next step
Use the correct incident channel now
If an incident may be active, contact your internal response lead and payment provider through verified channels. For general payment-processing questions after the incident is stabilized, Payments Max can help you organize non-sensitive workflow requirements.
To learn more about how TSYS can help improve the way your organization accepts payments, markets to new customers, or manages its HR responsibilities, get in touch by calling 585-981-8463 to get started.
CONTACT US