Data breach? Here's what to do, when and how