All tabletop exercises
Ransomware·Starter·Mixed audience
Your name appears on a leak site with a countdown
The prompt — read this to the room
A threat-intelligence feed alerts you that your regional law firm has been listed on a ransomware group's leak site. The post shows a timer with 72 hours remaining, a list of client names, and three screenshots of documents that look like your matter files. There has been no ransomware outbreak and no ransom note, and IT finds nothing encrypted. Partners are asking whether this is real, whether clients must be told before the timer runs out, and whether anyone should contact the group.
Total duration
1 h 15 min
People to involve
6
Best fit
Finance
Who to involve
Most important first.
- CISO / Head of security
- Legal counsel
- CEO / Managing director
- Communications / PR
- Incident response lead
- Privacy officer / DPO
What it tests
- Validate a leak-site claim with evidence rather than assumption
- Find the likely source of the data, including third parties that hold copies
- Decide whether, when and how to tell affected clients before the timer expires
- Agree a position on engaging the group, with legal and law-enforcement input
Outline of activities
- 1The listing and the screenshots
- 2Is it real? Matching documents to systems and suppliers
- 3Clients, regulators and professional obligations
- 4To engage or not
- 5Debrief: monitoring and response for data-only extortion
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…