Look-alike Email, Parking-Lot Pen Drive, and a Parent's Complaint
A coaching institute with eight staff runs its office on four shared desktop PCs. The student database - names, phone numbers, guardians' names, the last four digits of Aadhaar and fee payment status for about 600 students - sits in an unprotected Excel file on the reception PC's desktop, named 'students_final(2).xlsx'. All staff use the same login and the same password, 'coaching@123', unchanged for three years. Antivirus has not been renewed since last year and there is no backup.
On Monday three things happen. (a) The receptionist receives an email from '[email protected]' with the actual sending domain 'coachinginstitute.co.in', asking her to reply with the student list attached as it is 'needed urgently for a government audit'. (b) A pen drive is found in the parking area and a staff member wants to plug it into the accounts PC to 'see whose it is'. (c) A parent calls asking how the institute got her number, saying she keeps receiving coaching marketing calls.
1. Rank the three incidents in order of urgency and justify the ranking. What do you do about the email?
Read the worked answer
Ranking by how fast the damage happens:
- The email (minutes). 'coachinginstitute.co.in' against 'coaching-institute.in' is a look-alike domain, and 600 student records can leave in a single reply. First check whether the receptionist already replied, preserve the email headers, block the sender, and verify with the principal by phone on a number you already hold - never by replying. Warn all eight staff with a one-line message containing the fake address.
- The parent's complaint (already happened). This is evidence that data has already leaked. Start a written log: who has had access to the file, was it ever emailed or shared on WhatsApp, is a copy on any staff phone? Do not dismiss it as a wrong number.
- The pen drive (deliberate, not urgent). Easiest to prevent and easiest to get wrong: an unknown drive plugged into the accounts PC is how ransomware arrives. It is last only because it is entirely within your control.
2. What are the immediate containment steps for the student data, and what would you tell the parents?
Read the worked answer
Containment, in order:
- Take the file off the shared desktop into a folder only the principal and one accounts person can open, and keep one offline copy on an external disk.
- Kill the shared password today: separate accounts, strong unique passwords, automatic screen lock after five minutes. Eight staff sharing one password means no log can ever show who opened the file.
- Disable autorun, update antivirus, and keep that PC off general browsing until it has been scanned.
- Back up: 600 records with no backup is one failed disk away from total loss.
What to tell parents: if the complaint traces back to the file, state plainly what was exposed (name, phone, part of Aadhaar), what was not (full Aadhaar, bank details), and what has changed since. India's Digital Personal Data Protection Act, 2023 expects breach notification to the Data Protection Board and to affected individuals; record the principal's decision in writing and take legal advice where the exposure is serious. Silence is the option that turns a mistake into a scandal.
3. What do you do with the found pen drive, and what rules would you write so this month does not repeat?
Read the worked answer
The pen drive: never plug it into a machine holding student data. Seal it in an envelope, log where and when it was found, and hand it to the principal or the police as lost property. If it must be identified, do it on an isolated machine with updated antivirus, or not at all - the contents are not worth the risk.
Rules, and the reason for each:
- No personal removable media on institute PCs; if a drive is needed, use an institute-owned, labelled one, scanned on a standalone machine first.
- Autorun/autoplay off on all four PCs.
- Least privilege: reception does not need Aadhaar data to do reception work - give access to fee status only.
- One named data owner (the principal) who approves any external sharing in writing.
- Unique per-person passwords, changed when staff leave, never written on a noticeboard.
- Weekly offline backup kept in a locked cupboard, with a restore test once a month.
- Any request for student data, however urgent, is verified by phone on a known number before a single file is attached.