A. Send a notification to the competent supervisory authority describing the incident.

B. Send an email about the incident to all clients and ask them to change their passwords

C. Start an investigation to understand the incident's possible scope, duration and nature

D. Notify the police and Tile a criminal complaint about the incident