Nine Days of Exposure, Three Clocks, One Ransom Note
At 14:05 on a Tuesday, a security researcher emails Northwind Payroll, a SaaS provider serving 1,900 small employers, reporting an unauthenticated endpoint at /api/v1/exports that returns full employee records when given a sequential integer. The researcher supplies 40 sample records containing names, Social Security numbers, bank account and routing numbers, and 2023 W-2 wage data. Logs show the endpoint was reachable for nine days and was queried from 14 distinct IP addresses, three of them Tor exits. Northwind believes roughly 41,000 of its 260,000 covered employees were exposed.
Northwind's master services agreement requires customer notice within 24 hours of confirming a security incident. State breach laws where affected employees live require notice "without unreasonable delay," and outside counsel advises 30 days is the outer edge. Northwind has 1,240 employees in the EU and its DPO says GDPR Article 33 applies. The FBI field office asks Northwind to delay all notification for 72 hours while it traces the IPs. A ransom email demands 40 BTC to delete the data.
1. Sequence Northwind's first 72 hours and justify the ordering.
Read the worked answer
The clock starts at 14:05 Tuesday. Under GDPR Art. 33, awareness means a reasonable degree of certainty that a breach occurred - the researcher's sample supplies it.
- Contain (0–4h). Disable the endpoint, rotate credentials, snapshot logs, preserve the researcher's correspondence. Every hour of continued exposure enlarges the notifiable population and the eventual damages.
- Stand up the response team and outside counsel (0–6h). Nail down scope: which 41,000 of 260,000, in which states and countries. Scope drives every deadline downstream.
- Notify the EU controllers and, if Northwind is a controller, the supervisory authority by Thursday 14:05. The 72-hour ceiling does not bend to the FBI or to a client contract.
- Notify the 1,900 employer-clients by Wednesday 14:05. The 24-hour MSA term is contractual, and Northwind is a processor: its clients are the controllers who owe individual notice under state law. Withholding facts from them makes them late, and their lateness becomes Northwind's liability.
- Support individual notice at state pace. Pre-drafted letters, a call line, and a per-individual list of exposed elements, so clients can move in days rather than at day 30.
Note: the 30-day advice is an outer edge for low-risk breaches, not a target. SSN plus bank account plus W-2 wage data is a ready-made tax-fraud kit, and "without unreasonable delay" will not stretch to 30 days for this data set. The ordering is driven by who is exposed, who owes the duty, and who cannot act until Northwind speaks.
2. The FBI asks for a 72-hour blanket delay on notification. How should Northwind respond?
Read the worked answer
Treat it as a request to narrow and document, not a request to accept or refuse wholesale.
- Get it in writing, with the specific investigative need: which IPs, which suspects, what disclosure would compromise. A verbal delay request is the kind that later reads either as obstruction or as unauthorized concealment, depending on who is asking.
- Distinguish the audiences. A short delay of public disclosure, or of individual notice, may be justifiable to protect a trace. A delay of controller notice generally is not: the employer-clients must start their own clocks and can freeze affected payroll deposits. Give them the facts and the Bureau's request, and let them make their own call with counsel.
- Do not let it touch the GDPR clock. Art. 33 has no law-enforcement exemption of this shape; Art. 23 requires a legislative measure, not a phone call. The supervisory authority is notified on time.
- Reassess at 72 hours in writing, and extend only against fresh written justification.
On the ransom. 40 BTC to delete data you cannot verify has been deleted is a payment for a promise, and it carries separate sanctions exposure if the wallet is linked to a designated entity. Decline, preserve the demand as evidence, and spend a fraction of that sum on identity monitoring for the 41,000 - a remedy that can actually be delivered. Paying also confirms a business model that guarantees the next breach.
3. A client's general counsel says: "You told us in 24 hours but our employees won't hear for three weeks - that's a breach of trust." What do you say, and what do you do?
Read the worked answer
Concede the gap, explain the architecture, then close the gap instead of defending it.
What to say:
- Northwind's 24-hour notice discharges the MSA; it does not discharge the client's state-law duty to individuals. Those are different obligations on different clocks, and the client is the controller who owns the second one.
- But the 24-hour term exists precisely so the client can meet its own deadline. A three-week gap means something between notice and mailing is broken, and that is fair criticism.
What to do:
- Deliver a ready-to-send package: pre-drafted notices per state, an FAQ, a dedicated call line, and a per-individual list of the specific data elements exposed.
- Publish Northwind's own remediation timeline and fund credit monitoring for all 41,000. At roughly $10–20 per person, that is trivial against the fraud loss and the regulatory posture.
- Shorten the internal target to five business days for high-risk data sets (SSN plus bank account) and write it into the incident response plan with a named owner and a test.
The underlying point: the complaint is not really about 24 hours; it is that Northwind handed over a problem instead of a solution. The ethical obligation after a breach is to make affected people whole as fast as possible - not to be technically punctual while they wait for someone else to act.