Ransomware at the Cold-Chain Warehouse
At 21:40 on a Friday, ransomware encrypted the warehouse management system at three of 14 distribution centers of a cold-chain grocery distributor. The on-premises backup NAS is domain-joined; weekly tapes are offsite, but the last restore test took 36 hours. The order-fulfillment RTO is four hours and RPO is 15 minutes. Manual picking can sustain about 40% of normal throughput, and 2,000 pallets of temperature-sensitive product are in motion. Customer contracts require notice of a material service disruption within 24 hours; the insurer's cyber policy requires notice within 72 hours. The ransom note demands EUR 1.8 million and claims 400 GB exfiltrated. The incident response retainer's first call is scheduled in two hours. The CEO asks whether to pay and whether to tell customers before the facts are confirmed.
1. What should the incident commander do in the first 24 hours? Address containment, restoration sequencing, and the RTO gap.
Read the worked answer
Declare a major incident and separate containment from recovery. Isolate the three affected sites at the network layer, disable the domain-joined NAS to prevent further encryption, preserve logs and images before rebuilding, and verify whether the offsite tapes are clean by restoring to an isolated environment. Do not reconnect the NAS until credentials are rotated and the domain relationship is removed. Because RTO is four hours and manual throughput is 40%, invoke the business continuity plan immediately: prioritize the 2,000 temperature-sensitive pallets, assign manual pick lists, and notify transport partners of reduced capacity. Sequence restoration by business impact: order fulfillment for perishables first, then ambient, then reporting. Set a 24-hour decision cadence with the CEO, operations, legal, and insurer. The judgement is that a 36-hour tape restore cannot meet a four-hour RTO; the honest gap must be recorded as a continuity finding, not hidden by heroic overtime.
2. Build the notification decision for customers, the insurer, and regulators. What facts trigger each, and what should not wait for forensics?
Read the worked answer
Build a notification matrix before the next call. Customer contracts: 24 hours for material service disruption-if three sites cannot fulfill orders, the threshold is likely met; notify affected customers with facts, workaround, and contact. Insurer: 72 hours-notify the carrier now to preserve coverage and get forensic approval, even if the cause is unconfirmed. Regulatory: depends on jurisdiction and data type; if 400 GB exfiltration includes personal data, GDPR-style 72-hour notification may apply, and the clock starts when you have a reasonable degree of certainty, not when forensics is complete. Do not wait for attribution. Legal privilege: engage counsel to direct the forensic investigation, but privilege does not excuse regulatory notification. The CEO's question 'before facts are confirmed' should be answered with a staged notice: what is known, what is not, and when the next update will come. Delay to protect reputation is the wrong trade-off.
3. Should the CISO recommend paying the ransom? Give the reasoning and the conditions for any board override.
Read the worked answer
Recommend against payment as a security decision, while acknowledging it is a business and ethical decision for the CEO and board. Reasons: payment does not guarantee decryption; it funds criminal operations; it may breach sanctions depending on the actor; and it creates moral hazard for future attacks. The existence of 400 GB exfiltration means payment also does not resolve extortion or notification obligations. Have counsel screen the actor against sanctions lists, engage the insurer's negotiator only if the board wants to buy time, and test decryption keys on a sample in isolation if offered. Do not pay before validating backups and exhausting manual continuity. If the board overrides, document the rationale, the legal screening, and the fact that payment is not a control. The CISO's role is to give a clear recommendation with evidence, not to make the payment call alone.