Nine-day BPO compromise affecting an Indian bank and a German insurer
On a Friday at 18:40, ClearVoice, a Pune BPO serving an Indian bank and a German insurer, discovers a phishing compromise. An attacker had access to a customer-support drive for nine days. The drive held 82,000 call recordings, many containing names, policy numbers and health mentions; 3,100 screenshots with partial card numbers; and 240 EU policyholders' claim files. Encryption was enabled but the attacker used a compromised employee account, so the data was readable. The attacker demands INR 40 lakh in cryptocurrency and threatens publication. The bank's contract requires notice within 24 hours. The German client says 'GDPR 72 hours'. The CEO wants to pay and stay quiet. The forensic firm cannot yet confirm exfiltration scope. The insurer's EU customers were told in their notice that their data would not leave the EU.
1. Who must be notified, by whom, and when? Distinguish the DPDP, GDPR and contractual positions.
Read the worked answer
ClearVoice is likely a processor for both clients and a Data Fiduciary for its own HR and operations data. As processor, it must notify the bank and insurer without undue delay. The bank and insurer as controllers then decide on regulator and individual notification.
DPDP: Section 8(6) requires a Data Fiduciary to intimate a personal data breach to the Data Protection Board and to each affected Data Principal in the prescribed form and manner. There is no 72-hour clock, but 'without delay' means do not wait for full forensics. Issue a phased notification: known facts now, scope updates later.
GDPR: the German insurer as controller must notify its supervisory authority within 72 hours of awareness unless the breach is unlikely to result in a risk, and must notify affected individuals without undue delay where there is high risk (Articles 33-34). ClearVoice should give the insurer enough information to meet that clock, even if the 72 hours falls on a weekend.
Contract and India CERT-In: the bank's 24-hour clause applies. CERT-In directions require reporting of cybersecurity incidents within six hours. Do not let the CEO's preference override these duties.
2. Should ClearVoice pay the ransom? Advise the CEO.
Read the worked answer
Paying is not prohibited by Indian law, but it is not a safe or complete solution. The decision should be made by the CEO with legal, security and the clients, and documented.
Arguments against: payment does not guarantee deletion; it funds criminal activity; it may create sanctions or terrorist-financing exposure depending on the wallet; it may increase extortion; and it does not discharge notification duties. Concealment would be worse: the bank's 24-hour clause, the insurer's GDPR clock and CERT-In reporting all run independently of payment.
Arguments for: publication of health-related call recordings could cause serious harm, and payment may buy time for containment. If payment is considered, verify the wallet against sanctions lists, involve law enforcement, use a specialist negotiator, and do not pay before preserving evidence and notifying the clients.
The defensible position is: contain first, notify the clients immediately, preserve evidence, engage law enforcement, and make any payment decision separately and in writing. 'Stay quiet' is not an option; it converts a security incident into a governance and regulatory failure.
3. What should the first 30 days of containment and remediation cover?
Read the worked answer
Days 1-3: revoke sessions and reset credentials, enforce MFA, isolate the drive, preserve logs and forensic images, and establish a privileged investigation with a single decision log. Identify what the compromised account could reach and whether the attacker moved laterally.
Days 3-10: complete a scoping assessment, even if provisional; send the bank and insurer a structured incident pack; make CERT-In and DPDP Board notifications as required; prepare data-subject notification content with the clients; and stand up a call centre script for affected individuals.
Days 10-30: remediate identity controls, email filtering and drive permissions; review third-party access; test the restored environment; deliver a root-cause report to the board and clients; and update the incident response plan. Also investigate the EU data residency contradiction: if claim files left the EU contrary to the insurer's notice, that is a separate transfer issue the insurer must assess. Track all notifications, decisions and evidence in a breach register.