# Ecommerce Security Incident Response

> Contain suspicious activity, preserve evidence, coordinate notification decisions and improve controls after an incident.

- Type: Merchant guide
- Level: Intermediate
- Reading time: About 4 minutes
- Audience: Written for store owners, builders, and designers refining high-performance ecommerce stores.
- Last updated: 2026-11-04
- Canonical page: https://academy.getzenbasket.com/merchant-questions/ecommerce-security-incident-response/
- Part of: [Merchant Questions](https://academy.getzenbasket.com/merchant-questions/) on ZenBasket Academy

---

## What you need to know

### What is a security incident?

A security incident is an event that actually or potentially compromises confidentiality, integrity or availability and requires coordinated analysis or response.

### What should merchants do when suspicious activity is detected?

Record and triage the signal, contain immediate risk without destroying evidence, activate the right owners, and determine affected accounts, data and services.

### What should happen if an admin account is compromised?

Disable or restrict the account, revoke sessions and credentials, preserve logs, inspect actions and permission changes, restore verified access and assess customer or data impact.

### What should happen if an API credential is exposed?

Revoke the credential, block or limit affected access, issue a replacement, examine use and logs, notify relevant owners and correct where it was exposed.

### What should happen if customer data may have been exposed?

Contain further access, preserve evidence, identify data and people potentially affected, involve legal and privacy owners and follow applicable notification and contractual duties.

### What should an ecommerce incident-response plan contain?

The plan should define reporting, severity, roles, contacts, containment, evidence, investigation, communication, legal and provider coordination, recovery and post-incident review.

### How should security incidents be documented?

Maintain a dated timeline of evidence, decisions, actions, owners, communications and recovery verification. Protect the record and distinguish confirmed facts from hypotheses.

### What should happen after a security incident is resolved?

Verify normal operations and data integrity, reconcile affected transactions, notify as required, complete root-cause analysis, track corrective actions, and update training and plans.

### A quick store check

Run a tabletop compromised-admin scenario and document containment, evidence, notification decision, recovery and follow-up owners.

---

## Frequently asked questions

### Should the store announce an incident immediately?

Communicate promptly under the approved process, but verify facts and coordinate legal, provider and authority requirements.

### When can containment end?

After the team verifies, the threat is controlled and the recovery path will not reintroduce it.

## Related articles

- **Ecommerce Security Monitoring and Audit Logs**
- **Ecommerce Privacy Fundamentals**