Incident Response Plan for Ecommerce: Keep Orders Moving

On 12 October 2026 the websites of five US grocery banners owned by Ahold Delhaize went dark, and Cybersecurity Dive reported that the company had taken some systems offline as a precaution. Stores stayed open, while online ordering was suspended. Many owners think a retail cyber attack belongs to the giants. It does not. Below is an incident response plan, an ecommerce cyberattack response plan that a company of 20 to 300 people can prepare in a week: what to switch on first, who decides and what to tell customers.

Incident response plan after a retail outage: what smaller companies should learn

The lesson is not about the attacker. Physical shops kept trading, but the web store, the app and the delivery slots stopped, and every hour of that is lost revenue. A smaller shop has the same exposure with less cushion, and flaws like PHP2Shell show why it must update the PHP version within hours. When the website is down after a cyber attack and nobody knows who may switch systems off or back on, the first day goes on arguments instead of recovery. A written plan turns panic into steps.

A cyberattack response plan for ecommerce starts with revenue systems

List the systems in the order money flows: product catalogue, cart and checkout, payment gateway, order management, warehouse or supplier feeds, and the support inbox. Give each a rank and a target for how long it may stay down. Checkout and payment usually come first, because without them nothing sells. Stock and order management come second, because without them you cannot ship what you sold. Our ecommerce development services start from the same map, since a store is only as resilient as its weakest link in this chain.

System	Why it matters	Fallback
Checkout and payment	No sales without it	Payment link, invoice by email
Order management	Shipping depends on it	Shared sheet, one owner
Stock and suppliers	Prevents overselling	Daily manual count
Support inbox	Customers need answers	Phone line, status page

Backups: having one is not the same as testing a restore

A backup nobody has restored is a hope, and a response plan after a cyberattack built on hope stops at the first locked server. Set two numbers for each system: how much data you can afford to lose (RPO) and how long you can wait (RTO). Keep one copy offline or immutable, because ransomware goes after backups first, and keep the routine checks on a website security checklist. Then run a restore test on a clean environment, as in any cyber incident response drill, and write down the time it took. The cloud migration checklist describes the same rehearsal for moving systems, and it works as a template.

How often to test

Quarterly for checkout, yearly for the rest.

What to record

Date and duration.

Minimum mode in an incident response plan: manual orders and messages

Decide in advance what the shop does when the site is unavailable. A phone number, a payment link and a shared sheet can keep a trickle of orders going. Prepare three messages: a short notice for the homepage and social channels, a reply for support, and an email for customers with open orders. A business continuity plan for your online store should fit these messages on one page. An ecommerce cyberattack response plan keeps them ready, so that nobody writes them under stress.

Access, separation and roles: who decides when systems go down

Split admin accounts from daily accounts and switch on multi-factor authentication everywhere. Separate the shop, the office network and the payment environment, so that a problem in one does not stop the others. Name one incident lead, one person for customer communication and one contact for contractors, each with a deputy. Our DevOps services include exactly this separation of environments and access, because most outages spread through shared passwords.

1. Name the incident lead and a deputy.
2. Write down who may isolate systems.
3. Store phone numbers off the shop network.
4. Agree how long each decision may take.

GDPR and notifications: what companies serving EU customers must watch

If personal data may be affected, Article 33 of the GDPR expects notification of the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. Article 34 adds a message to affected individuals when the risk is high. Agree with your lawyer who files, and keep a data breach response plan with the facts. A plan nobody has read is useless when a cyberattack demands a fast response.

A one-page checklist and a yearly drill

Put the plan on one page: systems and ranks, backup status, the three messages, the roles and the notification rules. This ecommerce disaster recovery checklist then needs a yearly rehearsal, a tabletop exercise, and the CISA guidance for small businesses is a sound starting point. Switch off a test checkout and see how long it takes to answer a customer. An incident response plan for a small business that has never been rehearsed fails on the first call. Every incident needs a response, and a plan written beforehand makes the difference. Every plan we review for a shop has one gap: the response to a cyberattack is never practised.