DDoS with later evidence of unauthorized access
At 02:10 on a Tuesday, a distributed denial-of-service attack disabled the online banking and mobile payment services of an EU bank. Detection occurred at 02:25; the incident team restored login at 05:40, but payment initiation failed until 06:30 and the transaction backlog cleared at 09:00. The bank has 800,000 online banking users; 120,000 could not log in during the outage, representing 15% of retail clients. No customer data was exfiltrated at that point. The incident was classified as major at 06:00. At 14:00 the same day, forensic analysts found a webshell on an internet-facing server and evidence of unauthorized access to a payment API. The bank has not yet notified the regulator. The CISO asks whether the earlier classification and reporting timetable remain valid and what to do next.
1. Was the incident correctly classified as major at 06:00? Apply the DORA incident classification criteria and explain the key facts.
Read the worked answer
Classification. The 06:00 decision is defensible. DORA classification looks at critical services affected, clients affected, duration, geographical spread, data losses and economic impact. Online banking and payment initiation are critical services. The outage lasted more than three hours for login and over four hours for payment initiation, with a backlog until 09:00. The client impact is substantial: 120,000 users, or 15% of retail clients, could not log in. Those facts point to a major incident even though no data loss was known at 06:00.
The classification should record the facts and the uncertainty. At 06:00 the bank knew about availability impact but not about the webshell. A major classification was not premature; it was based on service criticality and client impact. The later discovery does not invalidate the original decision, but it changes the incident's known scope and severity. The bank should reassess using the new facts: unauthorized access to a payment API is a potential confidentiality and integrity event, not only availability. The classification and rationale should be logged.
2. Assuming classification at 06:00, state the reporting deadlines and the content of the initial notification. What changes when unauthorized access is discovered at 14:00?
Read the worked answer
Deadlines. Detection was 02:25 and classification was 06:00. The initial notification is due within four hours of classification and no later than 24 hours after detection. Four hours after 06:00 is 10:00; 24 hours after detection is 02:25 the next day. The binding deadline is therefore 10:00. If the initial notification is sent at 10:00, the intermediate report is due 72 hours later, at 10:00 three days later. The final report is due within one month of the initial notification. These are outside deadlines; the bank should not wait for full root-cause analysis.
Initial content. Use the supervisory template: entity identification, incident type, detection and classification times, affected services and clients, geographic impact, current status, known or suspected root cause, measures taken, and contact point. State what is known and what is not.
14:00 change. The bank should update the classification and notify the regulator without waiting for the next scheduled report. Unauthorized access may be a personal data breach, triggering a separate GDPR notification to the data protection authority within 72 hours if the threshold is met. Preserve evidence, contain the webshell and API access, and align the DORA and GDPR messages.
3. What internal governance and evidence should the bank have in place to support the report?
Read the worked answer
The bank needs a documented incident classification procedure with clear ownership, escalation triggers and a decision log. It should record who classified the incident, when, on what facts, and why major was chosen. It should maintain a timeline of detection, containment, restoration and backlog clearance, with system evidence rather than memory. Contact lists for the competent authority, data protection authority and senior management should be tested.
Evidence should include the incident ticket, alerts, forensic images, access logs, service status screenshots, customer impact calculations and board or committee notifications. The bank should also show that it considered the DORA criteria and reviewed the classification after new facts emerged. A short after-action review should identify whether the 06:00 classification was timely and whether the 14:00 discovery should have been detected earlier. The regulator will look for consistent facts across the initial, intermediate and final reports, not a perfect narrative at the first submission.