Isolate affected systems immediately.
Determine scope and categories of personal data involved.
Notify the Board and affected Data Principals as legally prescribed.