The Vendor Breach Nobody Owned
Arcadia Health Services outsources its patient-booking portal to a cloud vendor. The contract includes a security schedule but no audit rights, no breach-notification timeline, and no data-location clause. In March the vendor discloses, 11 days after discovery, that a misconfigured storage bucket exposed 40,000 booking records including names, dates of birth, and appointment reasons (which can imply a diagnosis). Arcadia's regulator requires notification 'without undue delay' and the board must be told within 72 hours. The CISO learned of the incident from a journalist, not the vendor. The vendor's account manager says the configuration error was Arcadia's responsibility because Arcadia's developer changed a setting. Internal logs are inconclusive. There is no incident response plan covering third parties, and the DPO has never seen the contract.
1. Assess Arcadia's position against its regulatory and contractual obligations. What has already gone wrong, and what is now at risk?
Read the worked answer
Regulatory exposure. The regulator requires notification without undue delay. Arcadia cannot meet that standard because it learned of the breach from a journalist, 11 days after the vendor's discovery. The 72-hour board clock is already running and the facts are unresolved. The data includes appointment reasons that may imply health conditions, so the sensitivity is high and the notification threshold is very likely met.
Contractual exposure. The security schedule has three structural gaps: no audit rights (Arcadia cannot verify controls or investigate), no breach-notification timeline (the 11-day delay may not even be a breach of contract), and no data-location clause (Arcadia may not know which jurisdictions hold the data, affecting transfer obligations). The DPO never seeing the contract is a control failure in its own right.
Attribution risk. The vendor blames an Arcadia developer. With inconclusive logs and no audit rights, Arcadia cannot establish or rebut this. Shared-responsibility ambiguity is the predictable result of a contract that never allocated responsibilities explicitly.
Governance risk. No third-party incident response plan means response is improvised, evidence may be lost, and the board may receive inconsistent information. The CISO's dependence on the media for notification undermines the credibility of the whole control environment.
2. Set out the immediate response and the structural remediation, distinguishing what must happen in the next 72 hours from what must change within six months.
Read the worked answer
Next 72 hours (containment and obligation):
- Convene an incident response team with named incident lead, DPO, CISO, legal, and communications.
- Demand written facts from the vendor: discovery time, scope, affected records, remediation status, and preservation of evidence. Invoke whatever cooperation clause exists.
- Make the regulatory notification decision on the facts available; do not wait for perfect attribution, since the obligation runs from awareness.
- Brief the board within the 72-hour window with known facts, unknowns, and decisions required.
- Prepare affected-individual communication and a press position, coordinated with the regulator's guidance.
- Lock down the misconfigured setting and confirm no further exposure.
Within six months (structural):
- Contract remediation: add audit rights, a mandatory breach-notification timeline (e.g., 24 hours from discovery), data-location and transfer terms, defined shared-responsibility matrix, and a right to forensic investigation. Apply to all material vendors, prioritised by data sensitivity.
- Third-party incident process: extend the incident response plan to suppliers, with escalation contacts, evidence-preservation steps, and a decision tree for notification.
- Contract governance: require DPO and security review before any contract handling personal data is signed; maintain a register of vendors and their obligations.
- Assurance: exercise a tabletop breach scenario including a vendor, and test notification timing end to end.
- Report to the board on root causes and residual risk, with owners and dates.