Contractor Exfiltration at Meridian Learning
Meridian Learning, a SaaS education platform, retains 90 days of cloud audit logs. GuardDuty alerts on a spike of S3 GetObject calls from a contractor's home IP at 02:00. The contractor had read access to a bucket with 2.1 million student records. DLP shows 4,000 records were downloaded to a personal device. The contractor's account is still active. The incident response plan says contain within 4 hours and notify privacy within 24 hours; the privacy team must decide on regulatory notification within 72 hours. The security team wants to delete the contractor's cloud account immediately, but the legal team wants forensic evidence. The contractor has not been reached, and the customer-facing team wants to send a breach notice now to all 2.1 million students.
1. What are the first containment and evidence-preservation actions, and how do you resolve the conflict between deleting the account and preserving evidence?
Read the worked answer
Contain without destroying evidence. Disable the contractor's credentials, revoke active sessions and refresh tokens, and suspend the account rather than delete it. Deletion would remove identity metadata, group memberships, and possibly audit context that legal and forensics need. Preserve cloud audit logs before the 90-day window advances, export relevant S3 access logs, and record the DLP evidence with hash values and chain of custody. Restrict the bucket to known service identities, rotate any credentials the contractor could have accessed, and check for persistence such as new keys, roles, or mailbox rules. Coordinate with HR and legal before contacting the contractor, and preserve the personal device through a documented process rather than informal requests. The customer-facing team should not send a notice to all 2.1 million students yet; notification scope depends on what data was actually exposed and the risk assessment. A holding statement can be prepared while facts are established. Suspension plus evidence preservation resolves the apparent conflict between security and legal.
2. How should the team decide whether the 72-hour notification threshold is met? Identify the facts still needed.
Read the worked answer
The decision should be documented against the applicable legal standard, not against the volume alone. The team needs to establish which data fields were in the 4,000 downloaded records, whether they include student names, contact details, grades, health information, or authentication data, and whether the data was encrypted with keys the contractor could access. It needs to confirm the contractor's authorization status, the destination device, whether the data was forwarded or posted, and whether other accounts or buckets were accessed. The 2.1 million figure describes bucket exposure, not confirmed exfiltration; a notice to all students could be inaccurate and alarmist. Conversely, waiting for complete forensics may exceed the 72-hour deadline. Use a structured risk assessment: nature of the data, likelihood of misuse, identifiability, and potential harm. If the threshold is met or cannot be ruled out in time, notify with the facts known and update later. Record the decision, the decision-maker, and the unresolved facts. The incident commander should set a decision point well before the deadline so legal has time to review.