All tabletop exercises
Ransomware·Intermediate·Executive audience
Double extortion: your name on the leak site
The prompt — read this to the room
Four days after you contained a ransomware attack and restored most systems from backup, a threat intelligence vendor emails your CISO a screenshot. Your company is listed on the group's leak site with a 72-hour countdown and a sample: forty scanned employee passports and a folder of customer contracts. The listing claims 600 GB was taken and will be published unless you pay $2.4 million. Your original investigation found no sign of data theft, and staff were told so. A trade reporter has already left a voicemail asking for comment. Do you engage, and what do you say?
Total duration
2 h
People to involve
7
Best fit
Saas, Finance
Who to involve
Most important first.
- CEO / Managing director
- CISO / Head of security
- Legal counsel
- Communications / PR
- Privacy officer / DPO
- CFO / Finance
- Board member
What it tests
- Decide the stance on engaging with or paying the extortionist, including sanctions screening, insurer consent and who holds the authority.
- Identify the notification obligations triggered by likely theft of personal data, and when each clock started.
- Agree a holding statement that corrects the earlier "no data taken" message honestly.
- Give staff whose identity documents may be published a concrete support plan.
Outline of activities
- 1The screenshot arrives: validating the claim
- 2Reopening the investigation: what was really taken
- 3The payment question: authority, sanctions and what payment buys
- 4Notification and disclosure triggers
- 5Media, staff and customers before the countdown ends
- 6Hot wash and a ransom decision framework for the board
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…