Ransomware With 71 Hours Left
At 14:00 on Friday, a European manufacturer’s security team confirms ransomware on 300 of its 2,000 servers. The attackers claim to have exfiltrated 2 TB, including 120,000 customer records and 8,000 employee records, but the forensic team has not confirmed exfiltration. The company operates in the EU, UK, and California. The GDPR 72-hour clock ends Monday at 14:00; the UK ICO expects notification within 72 hours where feasible; California requires notice without unreasonable delay. The affected customer data includes names, addresses, order history, and 4,000 payment-card tokens; employee data includes bank-account details for payroll. Backups exist, but the encryption key for one backup set was stored on an affected server.
The CEO wants to wait for forensic confirmation before notifying anyone. Outside counsel says notification could waive privilege and advises engaging the insurer. The attackers threaten to publish the data in 48 hours. Law enforcement asks the company to delay public disclosure to avoid tipping off the group. The company has no pre-drafted notification template and its call center has 30 agents.
1. Advise the CEO on whether to notify regulators and individuals before exfiltration is confirmed. Address the GDPR, UK, and California standards separately.
Read the worked answer
GDPR. Art. 33 requires notification to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to result in a risk to individuals. The standard is risk, not certainty. Ransomware on 300 servers, plus a credible claim of exfiltration of customer and employee data including payroll bank-account details, makes “unlikely risk” hard to sustain. The company should notify within 72 hours with the information it has, using Art. 33(4) to supplement in phases. Waiting for forensic confirmation is not required and may breach the deadline.
Individuals. Art. 34 requires notification without undue delay where the breach is likely to result in a high risk. Payroll bank-account details, names, addresses, and order history create a strong fraud risk. Payment-card tokens are lower risk if they are non-usable tokens, but they should not be assumed harmless. Notify affected employees and customers with practical mitigations, or document why a category is not high risk.
UK. The UK GDPR retains the 72-hour standard. The ICO expects notification where feasible within 72 hours; “feasible” does not mean “fully investigated.” Notify the ICO and, where high risk, individuals.
California. California Civil Code §1798.82 requires notification without unreasonable delay to affected California residents when unencrypted personal information is breached. Names plus bank-account details or other financial account information can qualify. The Attorney General must be notified if more than 500 California residents are affected. “Without unreasonable delay” is not a 72-hour rule, but the GDPR deadline and the attackers’ 48-hour threat make delay difficult to justify. The CEO’s proposed wait is not defensible across any of the three regimes.
2. What facts must be established in the next 72 hours, and how should the company document a decision to notify or not notify?
Read the worked answer
Facts to establish. (1) Initial access vector and whether it is contained; (2) whether exfiltration occurred, using firewall, proxy, endpoint, DLP, and cloud logs; (3) data categories and approximate volume by jurisdiction, including whether payroll bank details and payment tokens were accessible; (4) whether encryption or tokenization reduces usability; (5) backup integrity and the status of the backup key stored on an affected server; (6) number of affected EU, UK, and California residents; (7) risk to individuals-fraud, identity theft, physical safety, or confidentiality; (8) whether the attackers have published data or contacted customers; (9) law-enforcement requests and any insurer direction.
Documentation. Keep a contemporaneous incident log with timestamps, facts known and unknown, decisions, decision-makers, legal advice, and rationale. If the company decides not to notify a regulator or individual, record the risk assessment that supports “unlikely risk” or “not high risk,” and set a review date. Do not use privilege as a reason to avoid creating an operational decision record; separate legal advice from factual incident documentation. Preserve evidence, chain of custody, and forensic images. Draft notifications should be version-controlled, and regulator communications should be retained.
3. How should the company reconcile law enforcement’s request with its notification duties and the attackers’ 48-hour deadline?
Read the worked answer
Law enforcement can request delay of public disclosure to avoid tipping off the group, but it cannot suspend statutory notification duties. The company should tell law enforcement what it intends to notify, to whom, and when, and ask for a specific, time-bound request in writing. If law enforcement asks for delay, the company should limit the delay to public disclosure-not to regulator or individual notices-and document the request and its response.
The attackers’ 48-hour publication threat cuts the other way: it increases the risk to individuals and makes early individual notice more important. The company should prepare and, where feasible, send individual notices before publication, with call-center scripts, fraud-monitoring guidance, password resets, and credit monitoring for affected employees. The 30-agent call center is insufficient for 120,000 customers plus 8,000 employees; the company should scale through email, self-service, and temporary staff, and prioritize payroll-account and payment-related notifications.
Regulator notification should proceed within the GDPR/UK 72-hour window with phased information. The company should not pay or negotiate under the attackers’ deadline without legal and insurer involvement, and it should not let the ransom decision drive the notification decision. Notify, document, and coordinate-do not choose silence.