Customer Database Breach Lab
Your customer database is for sale on a forum. Verify the sample, scope 2.1 million records, decide when the clocks started, choose between notifying now or waiting for forensics, handle an extortion email and write the customer notice. Ten scored decisions, with branches.
Template & sample only — a structured starting point with sample content, not legal, audit, certification or investment advice.Customise it with your own details for free; exporting the generated document is part of Pro.
A seller on a criminal forum is offering what they say is Lumen Home Goods's customer database. You are the CISO. Verify the claim, scope what was taken, decide when the notification clocks started, handle an extortion email and write the customer notice. Ten decisions, each scored with feedback on why it matters and what it costs.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
What this template gives you
- Ten decisions from the first threat-intel alert to the post-incident review, each scored 0–10 with feedback on why it matters, what it costs and what it does to the notification clock.
- Branches change the story: ignore the tip and customers are phished first; wait for forensics and the regulator calls you; pay the extortionist and the data appears anyway.
- Realistic artefacts: the forum listing, a database audit-log line showing the export, the extortion email, residency splits for the US state deadlines.
- Rename the organisation and roles so the debrief reflects your own team.
Frequently asked questions
When does the GDPR 72-hour clock start after a database leak?
When the controller becomes aware — has a reasonable degree of certainty that a security incident has compromised personal data. Confirming that a leaked sample matches your production data is usually that point. Record the time and the reasoning. Confirm with counsel.
Should we wait for the forensic report before notifying?
Generally no. GDPR allows information in phases, and many other regimes expect an initial notice followed by updates. A late complete notice is usually worse than an on-time partial one.
Does paying an extortionist remove the duty to notify?
No. Payment buys a promise from a criminal, not deletion, and the duty to notify depends on the risk to the people affected, which payment does not change.
Is this a finished document I can rely on?
No. Every tool in this suite is a template with sample content. It gives you a structured, editable starting point and generates a document from your own answers, but it is not legal, audit, certification, investment or professional advice. Review and adapt the output, and have it checked by the appropriate specialist before you rely on it.
Who can use it?
Anyone. Using it and customising it with your own details is free, and your work is saved in your own browser. Exporting the generated document (Word, PDF, Markdown, CSV) is part of any PlayCISO paid plan.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.