Production Data in UAT, a Shared VPN Account and Three Blocked Emails
During a UAT refresh a bank's testing team restores a production extract of 1.9 million customer records into the QA environment so a new loan-origination module can be tested against realistic data. The extract includes name, PAN, masked Aadhaar, mobile number, address and loan balances, but no card numbers or PINs. Fourteen engineers from an offshore QA vendor reach the environment through one shared VPN account whose password has not changed in 19 months; there is no MFA on the VPN. Eleven days after the refresh, the DLP gateway blocks three emails from a QA lead to a personal Gmail address, each carrying a CSV of about 2,400 records. The QA lead says the file was needed for 'parallel testing at home'. Separately, an internal audit walk-through finds 6,000 scanned KYC PDFs on a shared drive that all 400 operations staff can open. The CISO must decide what to call this, whom to tell, and what to fix first, with a board meeting in nine days.
1. Is this a personal data breach requiring notification? Which obligations attach, and what facts do you still need before finalising?
Read the worked answer
Classification: two findings of different severity. The Gmail exfiltration is an actual or attempted confidentiality breach - three sets of about 2,400 records transmitted outside the bank's control, blocked at the gateway but only after transmission. The shared drive is an exposure (uncontrolled access), not yet a proven breach; the 6,000 PDFs may have been read by anyone in operations.
Obligations that attach now:
- CERT-In 2022 directions: data breach and unauthorised access are reportable, within 6 hours of noticing.
- RBI cyber incident reporting: 2-6 hours.
- DPDP Act 2023 s.8(6): notify the Data Protection Board and each affected data principal, in the prescribed form and manner. The rules are still being operationalised, so legal must confirm the current position before you promise customers anything.
- IT Act s.43A (compensation for failure to protect sensitive personal data) and s.72A (disclosure in breach of contract) create civil and criminal exposure; the vendor contract is the first place to look.
Facts still needed: whether the three blocks were the only attempts (search the mail gateway for 12 months for the sender and the domain); whether any CSV left before the refresh; whether the attachments were encrypted; whether the shared VPN account was used from outside India; and whether the 2,400-record population overlaps the 1.9 million extract. Do not issue customer notices on the assumption that DLP caught everything.
2. Prioritise the remedial actions and justify the sequencing.
Read the worked answer
Sequence by exposure, not by tidiness:
- Next 72 hours: disable the shared VPN account, kill its active sessions, rotate vendor credentials, and suspend the QA lead's access. Preserve his laptop and mailbox - suspension is not evidence destruction.
- 48 hours: pull VPN, DLP and mail-gateway logs to establish the full set of exfiltrations and identify the affected customers; put the vendor on written notice and invoke the audit clause.
- 14 days: purge the production extract from UAT and re-provision with masked or synthesised data. If realistic data is genuinely required, use tokenisation with re-identification held by the bank, not the vendor.
- 30-90 days: per-user vendor identities with MFA, just-in-time access and session recording; least privilege on the shared drive; DLP rule tuning and, more importantly, an escalation SLA - the 11-day gap between the block and the escalation is a process defect, not a tool defect; KYC repository permissions and retention purge.
Reasoning: masking the UAT data fixes the next refresh but does nothing about 7,200 records already out and 6,000 PDFs exposed. Containment and scoping must precede remediation, or you remediate a problem you have not measured.
3. What action would you take against the QA lead and the vendor, and what must the board note contain?
Read the worked answer
QA lead: treat as a disciplinary matter under HR policy after a factual investigation; do not prejudge. The material questions are whether he was told the data was masked or non-production, whether similar requests had been refused before, and whether the CSVs were opened. Suspension pending inquiry is proportionate; dismissal on a DLP alert alone is not.
Vendor: the shared account is their control failure as much as yours. Invoke the security schedule - audit rights, notification obligation, indemnity, right to suspend work. A temporary pause on new releases is proportionate; termination on 11 days of facts is not unless the logs show worse.
Board note must contain:
- Facts established and facts still open, explicitly separated.
- Population affected: 7,200 records in three blocked emails, 6,000 PDFs exposed, overlap unknown.
- Obligations triggered and filed, with timestamps.
- Root cause in one line: production data was permitted into a shared-credential vendor environment, and DLP escalation was not monitored.
- Cost estimate: notification, credit monitoring if PAN is involved, legal, contract remedies.
- Remediation with owners and dates, and the residual risk the board is accepting meanwhile.
Judgement point: the board will ask whether this happened before. Answer from logs, not memory - the password unchanged for 19 months is the real finding, and it will be in the audit report whether you put it there or not.