What to Do If an Unencrypted USB Drive Is Used to Deliver an Employer Report: Incident Response Checklist

How should you report and contain the USB drive incident?

Report the incident promptly through your organization’s security or incident-response channel. Notify your supervisor and the appropriate IT or information-security team; involve privacy, compliance, human resources, or legal staff when the report may contain personal, confidential, or regulated information. Follow your organization’s escalation and incident response documentation procedures.

Until security staff advise you otherwise, do not plug the drive into another computer, copy its contents, delete files, reformat it, or attempt to encrypt it. If you have the drive, keep it secure and limit handling. If it has already been connected to a device, tell the security team which device and when; they can decide whether to isolate that device and preserve relevant logs. Prompt reporting and coordinated containment help the organization investigate without needlessly altering potential digital evidence. See NIST’s incident-response recommendations and the FTC’s data-breach response guide.

If the drive was delivered to its intended recipient, say so. The use of an unencrypted drive may violate an internal portable-media encryption policy, but that fact alone does not establish that an unauthorized person accessed the report or that a legally reportable breach occurred.

What details should you record about the drive and its handling?

Record facts as soon as you can, using your organization’s approved incident reporting process. Distinguish what you directly observed from what someone else told you, and label uncertain details rather than guessing.

• Drive details: make, model, color or label, serial number if visible, capacity, and any identifying marks. Record whether it appeared encrypted and how that was determined; do not test it by inserting it into an unapproved device.
• Delivery details: when and where the drive was prepared, transported, and received; who sent and received it; how it was packaged; and whether it was left unattended, lost, or handled by anyone else.
• Handling and access: each person known to have possessed or connected the drive, the times and locations involved, which computer or system it was connected to, and any known copying, viewing, or transfer.
• Actions taken: when the incident was reported, whom you notified, where the drive was secured, and any instructions received or containment steps completed.

Preserve original messages, delivery records, and relevant system logs according to the response team’s instructions. If the organization formally collects the drive as evidence, record who collected or handled it and each transfer. NIST recommends preserving incident information and its integrity and provenance; its incident-response publication discusses evidence handling and documentation.

How do you assess the data and potential exposure?

Have authorized staff identify what the report contained and how many people, accounts, or business processes it involved. Record the report’s title and version, date range, file names, and data categories without creating unnecessary extra copies of sensitive information. Consider whether it contained employee or customer identifiers, financial or health information, confidential business data, or information that could be combined with other data to identify someone.

Establish who was authorized to receive the report, whether the delivery reached that person, and whether any other person could have accessed the drive. Check available handoff records, endpoint and access logs, and statements from people who handled it. Determine whether the information was actually viewed or copied where evidence is available; do not treat lack of evidence as proof that it was not accessed.

Document the encryption status, the period during which the drive was outside the organization’s control, the number of affected records or individuals if known, and what steps could reduce the risk. These facts support a data breach risk assessment. For incidents involving HIPAA-regulated information, HHS identifies the information’s nature and extent, the recipient, whether it was acquired or viewed, and mitigation as factors in assessing whether there is a low probability that PHI was compromised. See HHS’s HIPAA Breach Notification Rule guidance.

Which credentials and systems may need immediate protection?

Check whether the report or drive contained passwords, authentication codes, API keys, access tokens, connection strings, or other secrets, and whether it exposed system names or access instructions that could help someone reach internal resources. Have IT or security staff determine whether those secrets were usable and who could have obtained them.

If credentials or access tokens were exposed, or the organization cannot reasonably rule out exposure, ask the responsible system owner to revoke or rotate them promptly. Review relevant sign-in and system logs for suspicious activity, and restrict access or add monitoring where the assessment indicates a risk. Record each change and its time so investigators can distinguish response actions from earlier activity. Do not change shared credentials or delete logs independently; coordinate those steps with IT or security to avoid disrupting operations or losing evidence.

How should the organization assess breach notification requirements?

Refer the findings to the organization’s privacy or legal team. Notification obligations depend on the information involved, the organization’s role, applicable federal and state law, contracts, and the facts of the incident. An unencrypted drive or a policy violation does not, by itself, determine whether notification is required.

For HIPAA-regulated entities, assess whether the event involved an impermissible use or disclosure of unsecured protected health information. HHS explains that such an event is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised through the required risk assessment. If notification is required, the HIPAA rule generally sets an outer limit of 60 days after discovery for notice to affected individuals; other notice requirements and timing depend on the circumstances, including the number of people affected. Consult the HHS breach-notification guidance and the organization’s counsel rather than assuming the HIPAA deadline applies to every employer incident.

For other personal information, counsel should check the laws applicable to the organization and affected people, as well as any sector-specific rules and contractual requirements. The FTC’s breach-response guide advises businesses to assess applicable state and federal requirements. Record the decision, its rationale, the person or team responsible, and any deadlines identified. Do not notify affected people or regulators on your own unless authorized.

What should the incident record include?

Maintain one controlled incident record that captures the report, investigation, decisions, and response. Limit access to people with a business need, and follow the organization’s evidence-retention and privacy procedures.

• Incident identifier, discovery and reporting dates, reporter, and response lead.
• Drive description, delivery route, known handlers, custody or storage history, and any connected devices.
• Report contents and sensitivity, estimated number of affected people or records, intended recipient, and known or possible access.
• Assessment findings, evidence reviewed, uncertainty or information gaps, and the basis for the exposure and notification decisions.
• Containment, credential changes, monitoring, communications, and other actions, with dates, responsible people, and outcomes.
• Notifications considered or made, applicable deadlines, approvals, and follow-up steps to prevent recurrence.

Keep a clear timeline and preserve supporting logs, messages, and records under organizational procedures. NIST recommends recording investigation actions and safeguarding the integrity and provenance of incident records in its incident-response guidance.

How can portable-media policies prevent recurrence?

Set a clear portable media encryption policy that identifies approved devices, permitted uses, required encryption, and who may authorize exceptions. Prefer approved secure file-transfer methods when available. Keep reports limited to the data needed for the task, restrict access to approved recipients, and use a separate secure channel for any decryption key or password.

Support the policy with practical controls: maintain an inventory of approved drives, train staff on secure delivery and incident reporting, track handoffs, and define how media should be scanned and handled before use. Make the approved process easy to follow and explain what employees should do if a drive is lost, delivered incorrectly, or found unencrypted. NIST’s storage-encryption guidance addresses protecting data stored on end-user devices and removable media.

In short, report the incident quickly, secure the drive without altering it, assess what data and access may be at risk, and document the organization’s decisions. Use the findings to determine any breach notification obligations and strengthen portable-media controls.

FAQs

Who should be notified when an unencrypted USB drive is used to deliver an employer report?

Notify your supervisor and the organization’s designated IT or information-security incident channel promptly. Include privacy, compliance, legal, human resources, or other responsible teams as the organization’s policy requires, particularly if the report contains personal, confidential, or regulated information. The organization—not an individual employee acting alone—should decide whether outside parties or authorities must be notified.

What information should be documented during the incident response?

Record the drive’s identifying details, whether it appeared encrypted, the report and data categories involved, the delivery timeline, everyone known to have handled or accessed it, where it was stored, and any computers to which it was connected. Also document the investigation findings, uncertainties, containment and credential-protection actions, notification decisions, and who approved each step.

When must affected people or authorities be notified?

There is no single deadline for every unencrypted USB incident. The organization’s privacy or legal team should determine which laws, regulations, contracts, and facts apply. For a reportable breach of unsecured PHI under HIPAA, affected individuals generally must be notified without unreasonable delay and no later than 60 days after discovery; other requirements can apply. See HHS’s guidance and consult counsel for the specific incident.

Should exposed credentials or access tokens be revoked?

Yes, if credentials or tokens were on the drive, may have been accessible to an unauthorized person, or cannot reasonably be ruled out as exposed, have the responsible IT or security team revoke or rotate them promptly. The team should also review relevant logs and document the changes. Coordinate these actions so evidence is preserved and systems remain secure.