Log the date, time, and nature of the suspected breach.
Immediately rotate all passwords and revoke API keys for affected systems (e.g., Tax software, CRM).