Ransomware at the Fund Administrator
On a Sunday, the fund administrator that produces NAV for 60% of a £9bn manager's funds reports ransomware. Its primary and backup systems are encrypted; restoration may take five days. Month-end NAV is due in three business days, and investor subscriptions and redemptions settle T+2. The manager's own cold-site plan exists but has not been tested in 18 months and relies on the same administrator for security pricing. The regulator requires notification of material operational disruption within 72 hours. Client service wants to pre-empt investor questions, and the board asks whether to delay NAV. The administrator's contract has a 99.9% availability SLA, a 12-hour incident notification clause, and no specific cyber recovery obligations. The manager has two staff who can run a manual NAV, but only for the four largest funds.
1. How should the manager prioritise recovery and communications in the first 48 hours?
Read the worked answer
The first priority is to establish what data and services are actually unavailable, not to assume the administrator's five-day estimate is fixed. The manager should activate its incident management team, assign a single point of contact with the administrator, and obtain a written status on backups, security pricing, cash balances and investor records. In parallel, it should protect its own systems by confirming that no shared credentials or network links are compromised.
Recovery should prioritise the four largest funds that can be run manually, because they represent the greatest investor and revenue exposure, but only if the firm has independent access to security prices and cash. Client communications should be factual and pre-emptive: acknowledge the incident, state what is and is not affected, and give a next update time without speculating on NAV. The reasoning is that investors and the board need controlled information, while operations need to stabilise data sources before promising a NAV date.
2. Should the board delay NAV, and what regulatory notification approach is appropriate?
Read the worked answer
A delay is likely unavoidable for most funds, but the board should not announce a blanket delay until it knows which funds can be produced manually and whether the prices are reliable. For the four largest funds, a manual NAV may be possible with enhanced sign-off; for the remainder, a documented delay with a revised timetable is more defensible than publishing an inaccurate NAV. The board should approve a fund-by-fund decision and record the rationale.
The regulatory notification should be made within the 72-hour window if the disruption is material, even if the full impact is still being assessed. The notification should describe the affected services, investor impact, containment and expected recovery, and should be updated as facts change. The reasoning is that waiting for certainty can breach the deadline, while early notification with caveats is normal in operational incidents. Client service should align its messages with the regulator and the administrator, not contradict them.
3. What resilience and vendor oversight lessons should be escalated to the board?
Read the worked answer
The incident exposes concentration risk: the firm relies on one administrator for NAV, security pricing and possibly cash data, and its cold-site plan depends on the same provider. The board should require a tested exit and manual fallback for critical funds, independent access to prices and cash, and recovery-time objectives that are realistic for a cyber event, not just an availability SLA. The 99.9% availability SLA is not a recovery plan.
Vendor oversight should add specific cyber recovery obligations, evidence of backup isolation and restoration testing, incident notification at the time of discovery, audit rights and subcontractor visibility. The firm should also test its own plan at least annually with a scenario that removes the administrator entirely. The reasoning is that outage planning based on a provider's standard SLA does not cover ransomware, and the firm remains accountable to investors and the regulator for operational resilience.