Notification, Privilege and Ransom Decisions on a 72-Hour Clock
Verdigris Analytics, a publicly traded US SaaS provider, serves 400,000 US customers and holds data on 2,400 EU data subjects; one customer is a German hospital. On 3 March engineers detect anomalous access to a production storage bucket. Logs are incomplete and the firm cannot yet determine whether customer files were read or only listed. Outside counsel engages a forensics firm on 4 March, but on the same day the CTO emails all staff a two-page narrative of what happened and what he believes was exfiltrated. Forty enterprise MSAs require notice within 72 hours of "becoming aware" of a security incident. A threat actor demanding $900,000 in Monero has set a 72-hour deadline, and the ransom note references files belonging to the German hospital.
1. Build the notification decision. Address the GDPR clock, the 40 MSAs, the SEC, and the fact that you cannot yet tell whether files were read.
Read the worked answer
Treat the three clocks as running on different triggers.
GDPR: the 72 hours runs from awareness of a personal data breach, not from confirmation of exfiltration. Notification is excused only where the breach is unlikely to result in a risk; "we cannot rule it out" is not that standard. With 2,400 EU subjects and a German hospital customer, assume notifiable and prepare a notification that states the uncertainty honestly, with a committed update cadence.
MSAs: 40 contracts requiring notice within 72 hours of awareness are almost certainly stricter than statute and independent of it. Read the definition of security incident - most cover unauthorized access regardless of confirmed exfiltration - and notify even where the legal analysis is incomplete, because missing a contractual deadline is itself a breach.
SEC: begin and document the materiality assessment now; the Form 8-K is due within four business days of the materiality determination, not of the incident. Sequencing matters - enterprise customers and a hospital are likely to disclose publicly, so coordinate the filing with contractual notices rather than letting a customer announcement precede it. Preserve the interim reasoning; how the firm handled uncertainty is the artifact that gets examined.
2. What should counsel do about privilege, and what did the CTO's all-staff email do to the analysis?
Read the worked answer
Privilege attaches to communications made for the purpose of obtaining legal advice, and courts increasingly ask whether counsel actually directed the investigation and whether legal advice was the primary purpose rather than a label applied after the fact. Counsel should engage the forensics firm directly, define scope in the engagement letter, route interim findings through counsel, and maintain two tracks: a factual incident report usable for regulatory and contractual disclosure, and a separate privileged analysis. Distribution must stay inside the need-to-know circle.
The CTO's email is the problem. It is a non-privileged written narrative - discoverable in litigation, producible to regulators - and it fixes a factual account, including his belief about what was exfiltrated, that forensics may contradict in three weeks. It cannot be clawed back and must not be deleted; destruction after a duty to preserve attaches is far worse than the content. Preserve it, determine whether it was forwarded, and tell staff that written speculation about scope becomes evidence. Where the narrative conflicts with findings, document a reconciliation through counsel rather than allowing the earlier email to stand as the record of what the company knew and when.
3. The ransom deadline is 72 hours. What must be established before any payment decision?
Read the worked answer
Payment is a legal and sanctions question before it is a commercial one. Required before authorizing anything: screening of the actor, wallet addresses and any intermediaries against the SDN list and other applicable sanctions lists, documented contemporaneously, because the liability here is strict and does not require knowledge; counsel's written view on OFAC ransomware-payment guidance, including the risk-of-victimization factors and the expectation of prompt, full and truthful reporting to law enforcement and OFAC; early engagement with law enforcement, which is a mitigating factor and a condition in many policies; a check on any jurisdiction-specific prohibition affecting the entity or its affiliates; and confirmation from the insurer or broker that payment is not excluded and that reimbursement is not barred by a sanctions exclusion.
Separately, the business case: whether decryption keys work, what the actor's deletion promise is worth, and whether payment invites follow-on targeting. The German hospital changes the harm profile materially - payment may need to be conditioned on evidence specific to that data, and the reputational calculus differs from a purely commercial loss.