The Listed Bank's Cyber Breach and the CFO's Dinner
Tembo Bank Ltd is listed on the NSE. On Friday, its fraud team discovers that a vendor exposed 40,000 customer records, including IDs and loan balances, and that a junior treasury dealer lost KES 60 million on unauthorized FX positions. The CEO wants to wait until the audit committee meets in 12 days to issue a profit warning and notify the CMA, hoping the breach can be contained. At dinner, the CFO tells a friend who manages a hedge fund that 'the numbers will be ugly' and that the friend should sell Tembo shares before Monday. The friend instructs a broker on Monday morning to sell. The bank's data protection officer has not notified the ODPC. A journalist calls.
1. When should Tembo disclose the breach and the trading loss, and can it wait for the audit committee?
Read the worked answer
Tembo should not wait 12 days. Once the bank has inside information that is sufficiently precise and likely to have a significant effect on its share price, it has a disclosure obligation to the market. A data breach affecting 40,000 customers plus a KES 60 million unauthorised trading loss is material on its face, and the CEO's hope that it can be 'contained' does not suspend the obligation.
The board or a properly authorised committee should prepare an immediate announcement covering what is known, the likely financial and operational impact, the remediation steps and the fact that the investigation is ongoing. A profit warning may be required if the loss will materially affect results. The CMA and NSE should be engaged on timing and content. Any delay must be lawful, documented and notified to the CMA; it cannot be used simply to avoid bad publicity.
The CEO and CFO also need to preserve documents and avoid selective briefing of analysts or journalists. The journalist's call should be handled through a single spokesperson with an approved statement. Selective disclosure to the press before the market announcement could itself be a market-abuse issue.
2. Analyse the CFO's dinner conversation and the friend's share sale. What should the bank and the CMA do?
Read the worked answer
The CFO likely disclosed inside information. The statement that 'the numbers will be ugly' was made by a person with access to inside information, to a friend who managed a fund, and it was followed by a sale before the market announcement. The friend's decision to sell on Monday is consistent with trading on inside information.
The elements the CMA would examine are whether the information was precise, non-public and price-sensitive; whether the CFO knew or ought to have known that the friend might trade; and whether the friend knew or ought to have known that the information came from an insider. The short interval between the dinner and the sale, the friend's professional role and the direction of the trade all support a suspicion.
Tembo should escalate to its board and to the CMA, preserve the CFO's communications and trading records, and consider suspending the CFO from sensitive duties pending investigation. The CMA should review trading records, telephone and message data, and the fund's positions. Possible outcomes include criminal referral, civil penalties, disgorgement of profits and market-access restrictions.
The bank should also review its insider list, closed-period policy and pre-clearance rules. A tip-off to a friend is not a private matter; it undermines market integrity.
3. What data-protection steps are required for the 40,000 exposed customer records, and what records should be kept?
Read the worked answer
The bank should notify the ODPC without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to data subjects. Here the exposed data includes IDs and loan balances, so the risk is high. Customers should be notified without undue delay with clear information about what happened, the data involved, the likely consequences and the steps they can take.
The bank should also:
- contain the breach and recover or confirm deletion of the data;
- assess whether the vendor had a valid data-processing agreement and security controls;
- provide credit-monitoring or fraud-awareness guidance where appropriate;
- review access logs to see who accessed the data;
- preserve evidence for the ODPC and any criminal investigation.
Records should include the breach log, the risk assessment, the ODPC and customer notifications, remediation decisions, vendor contracts and security reports. The bank should retain these for the period required by the Data Protection Act and its own records-retention policy, and ensure the records are available to the ODPC and the CMA if requested.
Waiting for the audit committee would compound the breach. Data-protection notification is separate from market disclosure and should not be delayed by the board calendar.