All tabletop exercises
Crisis·Intermediate·Executive audience
A breach that did not happen goes viral
The prompt — read this to the room
On Tuesday morning a post on a hacking forum claims to offer the ‘full database of a national pet-insurance company, 4 million customers’ and shares a 200-row sample. Within two hours it is on social media, a tech news site asks for comment, and your share price falls 6% at the open. Your security team checks the sample: the rows are real customers, but the fields match an old marketing list a former partner held, not your systems. Your logs show no intrusion so far. Customers are calling to cancel. How sure do you need to be before you say ‘we were not breached’?
Total duration
1 h 45 min
People to involve
7
Best fit
Insurance, Finance
Who to involve
Most important first.
- CEO / Managing director
- Communications / PR
- CISO / Head of security
- Legal counsel
- Incident response lead
- Board member
- Customer support
What it tests
- Set the evidence threshold for a public denial and avoid a statement that may need retracting.
- Investigate both the company’s systems and the third-party source of the data.
- Handle market-disclosure questions for a listed company with counsel.
- Respond to customers whose data appears in the sample, wherever it came from.
Outline of activities
- 1The claim spreads and the share price moves
- 2Validating the sample: whose data, from where
- 3What can be said, and how confidently
- 4The former partner and data-sharing obligations
- 5Customers, the market and the follow-up
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…