A privacy engineer at a healthcare technology company discovers that an internal analytics dashboard accidentally exposed a subset of customer records containing names, email addresses, and appointment histories to a group of employees who had no legitimate business need to access them. No external party accessed the data, and access was revoked within an hour. The privacy incident response plan is being invoked. What should the privacy team do FIRST?