What to do in the first 24 hours of a breach