Start by auditing your security logs to identify any unauthorized access. Determine whether the breach originated from within your organization or through a third-party service. Examine the timelines and the specific data accessed. Use cybersecurity tools to trace the breach's origin and understand its impact.