Skip to content
All tabletop exercises
Third party·Starter·Executive audience

A vendor holding your customer data appears on a leak site

The prompt — read this to the room

A threat-intelligence feed your team subscribes to posts a new entry: a ransomware group claims to have stolen 600 GB from a small order-fulfilment company. You use that company to ship orders, and you send it customer names, addresses, phone numbers and order contents every day. The listing includes a file tree with a folder named after your brand. The vendor has not contacted you. When you call, the owner says they "had a computer problem last week" and that their IT provider is handling it. You are the data controller for those customers.

Total duration
1 h 20 min
People to involve
6
Best fit
Retail, Healthcare

Who to involve

Most important first.

  • Privacy officer / DPO
  • Vendor / procurement manager
  • Legal counsel
  • CISO / Head of security
  • Communications / PR
  • Customer support

What it tests

  • Get facts from a small vendor that may not know what happened to it.
  • Assess notification duties as controller when a processor is breached.
  • Prepare customer communication and support for a breach you did not cause but own.
  • Decide what changes in vendor due diligence, data minimisation and contract terms.

Outline of activities

  1. 1The leak-site listing: is it our data
  2. 2Working the vendor: facts, evidence and their obligations
  3. 3Notification: regulators, customers and timing
  4. 4Customer communication and support readiness
  5. 5Vendor risk: minimisation, contracts and the relationship

Run sheet (Pro)

The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.

Loading…

More third party exercises

🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
A vendor holding your customer data appears on a leak site — Tabletop Exercise · PlayCISO