Provided are a computer program product, system, and method for managing reads and writes to data entities experiencing a security breach from a suspicious process. A suspicious process is detected that is determined to have malicious code. A breach time for a data entity is indicated in response to detecting the suspicious process performing an operation with respect to the data entity. A determination is made whether there is a copy of the data entity created after the breach time for the data entity. A copy of the data entity is created when there is no copy of the data entity created after the breach time.