What are the most effective first steps a company should take immediately after discovering a data breach?