THIS IS ONLY A DRILL (For Now): How to Conduct a Data Breach Response Drill

Updated: July 14, 2026 by Michael Bruemmer 3 min read December 8, 2017

“Are we next?” That’s the question companies around the world are grappling with as more high-profile data breaches make headlines. At a time when one in four organizations experience cyber-attacks, mishandling the response can do more damage than the breach itself.

We take precautions against dangerous situations every day. With years of practice either in school or at work, most of us know what to do if there’s an emergency. We conduct drills repeatedly because when we immediately know how to respond to a threatening situation, we can minimize destruction. Because of the high probability of a cyber-attack, businesses need to treat breach responses like internal drills, repeatedly practicing until it becomes instinctive.

Prepare your data breach response drill

A well-prepared incident response strategy should first define all breach scenarios (e.g., ransomware, malware, phishing, etc.) and their specific steps. Assembling a qualified team is also critical, individual roles and responsibilities should be defined and clearly communicated. After finalizing the essential components of your incident response plan, regular testing is crucial to ensuring your organization is equipped to handle the unexpected.

Practice makes perfect

Below are six principles to help guide your data breach response drill effectively:

  1. Bring in an outsider.Enlist the expertise of someone outside your organization to run the drills and serve as a moderator. A third-party facilitator allows you and your team to focus on individual tasks and responsibilities.
  2. Put aside plenty of time.At a minimum, give your team half a day to do the exercise and to debrief.
  3. It’s an exercise for everyone.All internal and external team members who will be involved in a data breach response need to participate in this activity.
  4. Expect the unexpected.Your drills should include various likelihoods and situations. Another benefit to bringing in an outside moderator is that they can throw unpredictable scenarios at your team.
  5. Debrief.After the exercise, the entire team should review, discuss each mock situation in detail, and identify any areas in need of improvement.
  6. Repeat every six months.Keep your team aware of the latest developments in the world of cybersecurity and prepared to tackle cyber threats by conducting drills every six months.

Executing these drills are invaluable and help prove to your stakeholders, customers and employees that your company takes data security seriously. The more you practice putting your plan into action, the better prepared you’ll be in a real-life situation.

Visit our websitefor more information about our offerings and how Experian can help you prepare and respond to data breaches.

Related Posts

Rethinking Charged-Off Portfolio Prioritization

Experian’s new Recovery Scores model turns portfolio intelligence into more focused recovery strategies, helping organizations improve returns, direct effort and accelerate speed to cash. The challenge isn’t simply working more accounts. Whether a debt buyer is evaluating an acquisition, an agency is deciding where to assign collector time or a lender is managing its own post-charge-off accounts, the question is similar: How can limited capacity be directed toward accounts with the greatest potential for recovery? Prioritizing accounts mainly by age, balance or when they were last worked may not show which ones are most likely to generate a recovery. With the new Recovery Scores model, organizations can rank charged-off accounts by expected collectability, providing a consistent signal to inform placement strategy and treatment decisions across the recovery lifecycle. Make collector capacity a strategic resource Working every account with the same level of attention isn’t always practical. The more useful question is: Where should teams focus first to protect speed to cash? Our model performance analysis found: 80% of recovered dollars come from the top 40% of accounts worked. The value isn’t simply a better ranking. It’s how organizations can use it for collections optimization. Score bands can inform different strategies for placement, outsourcing, auction and legal channel treatment rather than applying the same approach across an entire portfolio. For debt buyers: The scores can inform acquisition pricing and how a newly purchased portfolio is divided across internal collections, legal channels and resale. Expected collectability can shape debt portfolio analysis, including how a portfolio is valued and segmented before collection work begins. For agencies: Score bands can help teams focus collector resources on accounts with stronger recovery potential. For first-party lenders: Managing recovery internally, the scores provide another signal to help structure decisions about which accounts to work and in what order. Look beyond collectability alone Prioritization rarely comes down to a single variable. Consider two accounts that both rank highly for expected collectability, but one has a substantially larger balance. Their recovery likelihood may be similar, but the potential dollars recovered are not. The Recovery Scores model uses debt collections analytics by combining Experian’s bureau-based score with current balance information. This helps organizations consider both the likelihood of recovery and the potential dollars at stake, while sensitive balance information remains within the organization’s working environment. Monitor accounts as they change The first decision about an account is rarely the last. Teams continually make choices about treatment, placement and resource allocation as accounts move through the recovery process. Recovery Scores is also available as a trigger. When underlying information changes, teams can receive an update and reconsider an account’s placement without waiting for the next portfolio-wide re-score. An account that shows lower recovery potential today may have a different recovery outlook later. Turn recovery potential into a portfolio strategy When portfolios contain more accounts than teams can work at once, the question isn’t simply, “How many accounts can we work?” It is, “Where can our resources have the greatest impact?” The latest Recovery Scores model helps organizations sharpen placement and treatment decisions. It gives debt buyers a way to price and segment portfolios with greater confidence and gives lenders another tool to direct limited collector time across their own post-charge-off portfolios. Learn more about Experian Recovery Scores

November 10, 2026 by Zohreen Ismail
What Is a Third-Party Breach? How to Prepare for and Respond to Vendor Incidents

Learn what a third-party breach is and steps to prepare, contain risk, and support affected customers. Read more!

November 9, 2026 by Laura Burrows
Mortgage Underwriting Moves from Modernization Talk to Action 

Mortgage underwriting is entering a new phase. In a recent conversation with HousingWire’s Allison LaForgia, Michele Bodda, Group President of Experian Housing, Verification Solutions, and Employer Services, discussed how modern credit scores, alternative data and verification tools are changing how lenders evaluate borrowers.  Lenders can now judge modernization by its results, Bodda said. “Now we’re actually letting more modern scores get into underwriting to help price loans and go all the way through to securitization,” she told HousingWire. “We’re letting the scores and the data actually speak for itself instead of just talking about it.”  The Right Data at the Right Time  Modernizing underwriting means providing useful information at the right stage, rather than giving lenders everything at once. “You don’t need everything all at once. You don’t need everything on initial pull,” Bodda said.  Alternative data, such as rental payments and buy now, pay later activity, can help show how consumers manage obligations, especially those with thinner credit files. A thin credit file does not necessarily mean someone has a thin financial life.  “It’s our responsibility as one of the primary data providers to make sure we can make all of that available, so that we’re best representing the consumer,” Bodda said. A fuller view of data may help lenders identify creditworthy applicants who might otherwise be difficult to assess.  Simplifying Verification and Reducing Friction  Bodda also shared how Experian is making credit information more easily accessible and reducing unnecessary costs during the originations process, explaining that new enhancements to Experian’s Power Profile Plus allow lenders to pull credit data at the start of underwriting and request another score later without repurchasing the data.  “You can pull it later and not pay for the credit data again,” Bodda said.   Experian is also investing in income and employment verification, including through a new partnership with Workday. Bodda explained that Experian will continue to focus on process improvement, competition and innovation across the mortgage ecosystem.  A Broader Path to Homeownership  As consumer expectations and underwriting capabilities evolve, borrowers want a process that reflects their financial lives, while lenders seek greater efficiency. Modern scores, relevant data, and streamlined verification can help lenders assess applications with more context—and may help more people pursue homeownership.  “If we as an industry can open this up and bring more people into the process, then we’re going to thrive,” Bodda said in the interview.   Watch the interview and hear all of Michele’s insights, and more here.  

November 6, 2026 by Caroline Basile

Subscribe to our Newsletter

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Newsletter

Don't miss out on the latest industry trends and insights!
Subscribe