Incident response
If client data is compromised
If we confirm that client data has been accessed, lost, altered or disclosed without authorization, we act to contain the issue, understand its impact and help affected clients respond.
The response depends on what happened and which laws apply. We do not delay protective action while the investigation is still developing.
First priority
Contain
Then
Assess impact
Client care
Notify and support
Response
What happens next
- 01
Contain and protect
We restrict the affected activity, protect accounts and preserve the information needed to understand what happened.
- 02
Assess the impact
We determine what information was involved, which clients or people may be affected, the likely consequences and whether the issue is continuing.
- 03
Correct and recover
We address the cause, restore safe service and review related safeguards so the response covers the wider issue, not only the immediate symptom.
- 04
Notify affected parties
When a confirmed incident affects a client workspace, we contact that client using its registered account details. Required notices to individuals and authorities are made according to applicable law.
- 05
Document and improve
We record the timeline, impact, decisions and corrective actions, then use that review to improve safeguards and future response.
Notification
What an affected client can expect
A notice is written to help the client make decisions, not to hide the impact in technical language. When known and appropriate, it will include:
- What happened and when it was identified, to the extent known
- The categories of information and people affected
- What LeadNumbers has done to contain and correct the issue
- Practical steps the client or affected person should take
- How to contact us for updates or privacy support
Timing and legal notices
We notify affected clients promptly after confirming an incident that touches their workspace. Where a personal-data breach is likely to create risk for people, we notify the relevant authority within the period required by applicable law, including the GDPR 72-hour requirement where it applies, and inform affected people without undue delay when required.
Early notices may be updated as the investigation establishes additional facts. We will say clearly what is confirmed, what remains under review and what actions are recommended.
Your role
What clients should do
Report concerns
Send suspected unauthorized access or unusual account activity to hello@leadnumbers.com.
Preserve information
Keep relevant messages, dates and account details so the concern can be assessed accurately.
Follow the notice
Take the protective steps in our notice and contact us if your legal or security team needs clarification.
This page describes our response approach and does not guarantee that every incident will have the same facts, impact or legal requirements. It also avoids publishing confidential security architecture that could weaken client protection.