数据泄露通知草拟助手

个人身份信息数据泄露事件通知（模板）

通知编号：［编号］
发布日期：［日期］
适用对象：受本事件影响的个人信息主体（含可能受影响人员）

一、通知目的
本通知用于告知您一次涉及个人身份信息的数据泄露事件的基本情况、潜在影响、我们已采取和将继续采取的处置措施，以及您可以采取的风险降低行动。通知内容符合适用的数据治理政策和相关法律法规的要求。

二、事件概述
- 事件类型：未经授权访问/信息误传/系统配置错误/第三方服务受影响（请据实填写）
- 发现时间：［事件发现日期与时间］
- 发生时间窗口：［起止时间或无法确定的说明］
- 涉及系统与数据处理活动：［系统名称/业务流程/第三方供应商（如适用）］
- 事件原因（初步）：［例如：凭据泄露、权限配置缺陷、软件漏洞、员工操作失误］
- 当前状态：事件已被封堵/正在调查/已完成初步取证（据实说明）

三、受影响的个人信息类型
请据实列示本次事件中可能被访问或泄露的个人信息类别（不含未受影响的类型）：
- 基本身份信息：姓名、身份证件类型及号码、出生日期
- 联系方式：手机号码、电子邮箱、住址
- 账户信息：用户名、账户ID、登录凭据散列值（不含明文密码）
- 交易或业务信息：订单、合同编号、服务记录
- 敏感个人信息（如适用）：［例如：生物识别数据、银行账户信息、定位数据］
- 其他：［补充说明］
影响范围（估计）：［受影响人数/比例；地理范围；是否包含未成年人］

四、风险评估
- 可能风险：身份冒用、网络诈骗、钓鱼攻击、账户被尝试登录、定向骚扰
- 现有证据：［目前未发现/发现个案滥用迹象］
- 风险等级：［低/中/高］（依据数据敏感度、可识别性、泄露时长及外泄渠道评估）
- 影响判定方法：基于访问日志、取证结果、数据集类型与去标识化程度综合评估

五、我们已采取的处置与补救措施
- 事件响应：立即隔离受影响系统与接口，撤销异常访问权限，强制重置相关密钥与凭据
- 技术加固：修补漏洞、加固访问控制、增强日志与异常行为监测
- 数据处置：核验受影响数据集，必要时执行数据下线、脱敏或删除
- 取证与审计：保全证据、开展第三方独立安全审计与根因分析
- 供应商管理：对相关第三方进行合规核查与整改要求（如适用）
- 合规报告：已按适用法律法规要求向监管部门报送/将按要求报送事件信息
- 沟通支持：设立专线与邮箱受理咨询与权利请求，持续发布更新

六、您可采取的自我保护措施
- 账户安全：尽快更改与本事件相关账户密码，避免与其他网站复用；启用多因素认证
- 警惕欺诈：警惕索取验证码、密码或个人信息的来电、短信、邮件；不点击可疑链接
- 监测与冻结（如涉及金融信息）：定期查验账单与征信报告；必要时申请临时信用冻结或欺诈警示
- 信息核对：核实我们向您发送的官方域名和联系方式；如存疑请通过本通知提供的渠道求证
- 报警与举报：发现被冒用或财产损失，及时向公安机关报案并联系我方协助取证

七、合规说明与您的权利
- 法律遵循：我们将依照适用的个人信息保护法律法规（例如中国《个人信息保护法》、欧盟《通用数据保护条例》等）履行通知与报告义务
- 权利保障：在适用法律允许范围内，您可行使查询、复制、更正、补充、删除个人信息，以及撤回同意（如处理基于同意）等权利
- 权利路径：请通过下列联系方式提交权利请求；我们将在法定期限内处理并反馈
- 监管沟通：如您对我们的处理存在异议，您可以向所在地有管辖权的监管机构投诉或举报（如适用）

八、支持与联系方式
- 客服与事件咨询：［电话］（服务时间），［邮箱］
- 数据保护负责人/隐私联络：［姓名/职务］，［邮箱/电话］
- 在线受理入口：［网址或工单入口］
- 通信地址（用于书面请求）：［地址］

九、后续计划与更新
- 时间表：［预计完成全面调查与根因分析的时间］，［安全加固与整改完成时间］
- 更新机制：我们将通过［官网公告/邮件/短信］提供后续更新；重大进展将另行通知
- 持续改进：我们将完善数据治理与安全控制，包括访问最小化、加密与密钥管理、供应商合规审核、员工安全培训、数据留存与删除策略优化

十、附加支持（如适用）
- 身份保护服务：我们将为受影响个体提供［X］个月的信用监测/身份保护服务，费用由我方承担。具体开通方式将另行说明
- 未成年人保护：如涉及未成年人个人信息，我们将同步通知监护人，并采取更严格的保护措施

重要提示
- 我们不会通过电话、短信或邮件向您索取密码、短信验证码或支付信息
- 官方域名与联系方式以本通知为准；警惕假冒通知与社会工程攻击

如需进一步信息或协助，请通过上述渠道与我们联系。感谢您的理解与配合。

Subject: Notice of Security Incident Involving Account Credentials

Date: [YYYY-MM-DD]  
Incident Reference: [INC-XXXX]

Summary
We are notifying you of a security incident that involved account credentials associated with your [Organization/Product] account. Our investigation indicates that an unauthorized party obtained access to a system storing authentication data. We took immediate steps to contain the incident, protect accounts, and prevent further unauthorized access.

What Happened
- Date discovered: [YYYY-MM-DD HH:MM UTC]  
- Incident window: [Approximate start/end or “under investigation”]  
- Affected system(s): [System name or functional description]  
- Method of access: [e.g., compromised API key, vulnerability in third-party component, credential stuffing]  
- We engaged an independent digital forensics firm and activated our incident response plan upon discovery.

What Information Was Involved
Based on current findings, the following data may have been exposed:
- Account identifiers: [email/username/customer ID]  
- Password data: [hashed and salted passwords using <algorithm, e.g., bcrypt/Argon2> with a cost factor of <n>; no plaintext passwords are stored]  
- Session and authentication artifacts: [e.g., OAuth tokens, refresh tokens, session cookies, password reset tokens]  
- Multi-factor authentication (MFA) data: [e.g., TOTP seeds/recovery codes] (if applicable)

No payment card information, government ID numbers, or sensitive personal data were stored in the impacted system. If this changes as the investigation progresses, we will update this notice.

Actions We Have Taken
- Containment: Isolated affected systems and blocked the unauthorized access path.  
- Credential protection: Invalidated passwords, sessions, and tokens potentially exposed; enforced password reset at next login.  
- MFA protection: [Rotated TOTP seeds/recovery codes and required MFA re-enrollment] (if applicable).  
- Hardening: Patched vulnerabilities, rotated keys/secrets, increased logging and anomaly detection, and implemented additional rate-limiting and geo-velocity controls.  
- Investigation: Working with a third-party forensics firm and notifying law enforcement and relevant regulators as required.

What You Can Do Now
- Reset your password: If you have not already done so, create a new, unique password for your [Organization/Product] account. Do not reuse passwords from other sites.  
- Update reused passwords elsewhere: If you used the same or similar password on other services, change those passwords immediately.  
- Re-enroll MFA: Complete MFA re-enrollment if prompted. If you were not using MFA, enable it now.  
- Review account activity: Check recent logins, security settings, API keys, and authorized devices/applications. Revoke any unfamiliar tokens or sessions.  
- Be alert for phishing: We will not ask for your password or MFA codes by email, SMS, or phone. Verify messages originate from [official domain].  
- Developer accounts and integrations: Rotate API keys, client secrets, and webhooks. Update CI/CD secrets and invalidate cached credentials in build pipelines.

Current Assessment of Risk
- The primary risk is account takeover via credential misuse or reuse on other services (credential stuffing).  
- If MFA seeds or recovery codes were exposed, there is increased risk to MFA-protected accounts until re-enrollment is completed.  
- We have no evidence at this time of unauthorized activity within your specific account; however, monitoring is ongoing.

Ongoing Improvements
- Password storage: Validating configuration of [bcrypt/Argon2] with strong parameters and implementing server-side peppering.  
- Access controls: Strengthening IAM policies, least privilege, and periodic secret rotation.  
- Detection and response: Expanding telemetry, anomaly detection models, and 24/7 alerting and response runbooks.  
- Third-party risk management: Validating supplier controls and incident notification SLAs.

Support and Contact
- Dedicated incident support desk: [email@domain.com], [phone], available [hours and timezone]  
- Data Protection Officer (privacy inquiries): [DPO name], [DPO email], [postal address]  
- For security researchers or additional technical details: [security@domain.com or PSIRT alias]  
Please reference Incident [INC-XXXX] in your communications.

Regulatory Information and Your Rights
Depending on your location, you may have rights under applicable data protection laws (e.g., GDPR, CCPA/CPRA). These may include the right to access, rectify, erase, restrict, or object to processing of your personal data, and the right to lodge a complaint with your supervisory authority. To exercise your rights, contact [privacy portal URL or DPO contact]. We are providing this notice within the timelines required by [insert applicable laws/regulations], based on our current understanding of the incident.

Key Dates (to be updated as the investigation proceeds)
- Detection: [YYYY-MM-DD]  
- Containment: [YYYY-MM-DD]  
- Password and token invalidation completed: [YYYY-MM-DD]  
- Regulator notification: [YYYY-MM-DD], [Authority name]  
- Law enforcement report: [YYYY-MM-DD], [Agency, case number if available]

We regret this incident and are committed to protecting your information. We will provide updates at [status page URL or email updates] as our investigation progresses.

Sincerely,  
[Name]  
[Title, e.g., Chief Information Security Officer]  
[Organization]  
[Contact details]

数据安全事件通知（涉及邮箱地址）

收件人：受影响的个人
发件人：[公司名称] 数据保护办公室
日期：[YYYY-MM-DD]
事件编号：[INC-XXXX]

关键信息摘要
- 事件类型：邮箱地址信息被未经授权访问/泄露
- 受影响数据：邮箱地址（如 user@example.com）；目前未发现密码、身份证件号、支付信息等其他敏感数据受影响［如与实际不符请调整］
- 影响范围：[受影响账户数量或“正在核实”]
- 事件时间：发生于[日期时间]，发现于[日期时间]，已于[日期时间]完成初步处置
- 风险评估：主要风险为钓鱼/社工邮件与垃圾邮件增加

事件概述
在[日期时间]，我们发现与[系统/第三方供应商/存储位置]相关的配置/接口异常，导致部分邮箱地址被未经授权访问/可能被公开访问。我们于[日期时间]检测到异常并启动事件响应流程，立即采取了隔离与缓解措施。当前已控制风险，未发现进一步的异常访问迹象［如仍在调查，请改为“仍在监测”］。

受影响的数据类型
- 必定受影响：邮箱地址
- 暂无证据显示受影响的数据：密码、双因素认证信息、身份证件号、财务/支付数据、业务交易数据［按事实删改］
- 数据来源与用途：该邮箱地址用于[账户注册/通知服务/营销订阅等]，存储于[系统/供应商名称]，依据我们的数据政策仅作[具体用途]使用

事件原因与处置（截至本通知）
- 初步原因：疑似[配置错误/凭据泄露/API 访问控制缺陷/第三方服务漏洞]［待最终取证结论］
- 已采取措施：
  - 立即禁用异常访问路径、撤销可疑凭据、修复错误配置
  - 对相关系统进行日志留存、取证与全面安全扫描
  - 启用强化的访问控制与监测（最小权限、IP 允许名单、速率限制）
  - 提升邮件安全防护（SPF、DKIM、DMARC 策略校验与拒收策略收紧）
  - 通知并要求相关第三方供应商配合排查与整改（如适用）
  - 启动内部数据泄露响应与问责流程，并组织有针对性的安全加固
- 正在进行的工作：根