How do we tell customers what data was affected in a breach?
Honestly, specifically and only with what you know, then update them. Say what happened and when, which categories of their data were involved, what you have done, what you are still investigating, what they should do, such as watching for phishing that uses their details, and whom to contact. Avoid saying that no data was affected before the investigation supports it; a correction costs more trust than a careful first message. Agree the wording with your lawyer and data protection officer, because notifying individuals can be a legal duty with its own required content, and with your insurer. Send it through a channel that is not compromised, and warn customers that fake follow-up messages may circulate. Evidence makes the message precise: NetSenX alerts show which hosts sent unusual volumes out and when, which helps you say which systems, and so which customers, are concerned.