Ransomware Crisis at a National Warehouse Operator
Coastal Freight runs 48 warehouses and 11,000 employees. At 02:13 on a Saturday, EDR alerts show ransomware spreading across 60 servers; the WMS at 14 warehouses is down. Backups are domain-joined, and the only offline copy is six days old. The attackers exfiltrated 4.2 TB, including customer contracts, and demand $2.3M. The CEO wants to pay to restore faster; the insurer asks for proof of life and a notification decision; law enforcement requests 24 hours before public disclosure. Warehouse 12 is shipping manually, and the largest customer's SLA breach is 14 hours away. The crisis team has not tested the plan in 19 months, and the general counsel is unsure whether state breach notification is triggered.
1. What are the first 24-hour priorities and decision rights for the crisis team?
Read the worked answer
Declare a crisis and separate incident command from business continuity. Priorities: contain spread by isolating segments, disabling compromised accounts, and preserving evidence; protect safety and manual shipping; validate the offline backup and choose a restoration target; and establish a single decision log. Decision rights: the CEO owns payment and notification decisions; the incident commander owns containment; the COO owns warehouse continuity; the general counsel owns legal notification; communications owns external messaging. Do not let the CEO payment preference drive technical restoration. Honor the law-enforcement request as a timing input, not an absolute silence order beyond legal obligations. Verify what data was exfiltrated before notifying customers. This structure prevents parallel, conflicting decisions during the most uncertain hours.
2. How should the CEO decide whether to pay, and how should notification be handled?
Read the worked answer
Do not decide payment first. Assess decryptor reliability, restoration time from clean backups, legality and sanctions exposure, insurance coverage, and whether payment increases or reduces further extortion. Paying does not remove notification duties or the risk of leak. Notification depends on jurisdiction and data type: customer contracts and personal data may trigger breach laws, so involve counsel. Prepare a factual statement, notify the largest customer before the SLA breach if legally permitted, and coordinate with law enforcement. If the offline backup is six days old, quantify data loss and manual reconciliation cost. The CEO should document the decision rationale and review it with the board because this is a risk-acceptance decision, not only an IT decision.
3. Recommend restoration sequencing and the communications cadence.
Read the worked answer
Restore in business-critical order: safety and shipping at warehouse 12, then the highest-revenue warehouses, then corporate IT. Rebuild in a clean environment, rotate credentials, and validate backups before reconnecting. Use manual workarounds with paper controls and reconciliation. Communicate on a fixed cadence: employees every four hours, customers daily or at SLA milestones, regulators as counsel advises. Avoid overpromising restoration dates. After action, fix backup isolation, test the plan, and add a decision log. This sequencing protects revenue and safety while reducing the chance of reintroducing compromised systems.