All tabletop exercises
Data breach·Intermediate·Mixed audience
The attacker emails your customers directly
The prompt — read this to the room
Your accounting software company refused a ransom demand last week after a data theft. This morning hundreds of your small-business customers received an email from the attacker. It quotes each customer's own invoice data as proof, says you 'chose not to protect them', and invites them to pay 500 dollars each to have their records deleted. Support has 900 tickets in the queue. Two customers have posted the email on social media, and one says they have already paid.
Total duration
1 h 30 min
People to involve
7
Best fit
Saas, Finance
Who to involve
Most important first.
- Communications / PR
- Customer support
- CISO / Head of security
- Legal counsel
- Privacy officer / DPO
- CEO / Managing director
- Incident response lead
What it tests
- Regain control of the customer narrative within hours, not days
- Give customers clear, practical guidance, including what to do if they have paid
- Reassess notification duties now that the scope of stolen data is visible
- Use the attacker emails as evidence to sharpen scope and support law enforcement
Outline of activities
- 1The emails land: what they say and who received them
- 2Support under load: triage, scripts and escalation
- 3The company message to all customers
- 4Notification and law enforcement
- 5Debrief: planning for re-extortion in the ransom policy
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…