All tabletop exercises
Data breach·Intermediate·Mixed audience
Your customer database is for sale on a forum
The prompt — read this to the room
A security researcher messages your support inbox with a link. On a criminal forum, someone is selling what they call your full customer database: 1.2 million rows with names, emails, password hashes and the last four digits of cards, for $8,000. The 20-row sample contains real customers, and one is a member of your own staff. Nothing in your logs points to a breach. An engineer remembers a copy of production restored onto a test server for a migration two years ago. The researcher plans to publish a blog post on Friday. Where do you start?
Total duration
2 h
People to involve
7
Best fit
Retail, Saas
Who to involve
Most important first.
- CISO / Head of security
- Incident response lead
- Cloud engineer
- Privacy officer / DPO
- Legal counsel
- Communications / PR
- CEO / Managing director
What it tests
- Validate the sample and trace the likely source without destroying evidence.
- Set a notification position under GDPR Art. 33/34 and US state breach laws, with the clock started at the right moment.
- Work with the researcher constructively and plan around the Friday publication.
- Decide customer-protective actions (password resets, fraud monitoring) before all the facts are in.
Outline of activities
- 1The researcher’s message: is the sample real?
- 2Finding the source
- 3When did we become aware? Setting the notification position
- 4The researcher, customers and Friday
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…