Ransomware Outage on a Filing Deadline and an Unconfirmed Data Breach
On a Friday afternoon before a filing deadline, the court's electronic filing portal becomes unavailable. The vendor reports a ransomware incident at a subcontractor; the portal has been down for six hours. Approximately 1,200 filings are normally received on the last day of the month. The court's continuity plan includes a paper drop-box procedure, but the local bar reports that self-represented litigants do not know about it. The court's website is hosted by the same vendor and is also intermittently unavailable. The clerk's office has 12 staff, three of whom have received cybersecurity training. The court's remote hearing platform is separate but uses the same identity-management provider. The administrative judge asks you to authorize emergency procedures, including an automatic extension of filing deadlines by 24 hours, and to decide whether to notify the public about the identity-management link. The vendor's service-level agreement provides credits for downtime but no expedited forensic support. The state supreme court requires courts to report any breach involving confidential data within 72 hours, but the vendor has not confirmed whether data was accessed.
1. Design the emergency filing and continuity response for the next 24 hours. Address the paper drop box, self-represented litigants, and the proposed blanket extension.
Read the worked answer
Activate the continuity plan immediately, but do not rely on a blanket 24-hour extension as the only response. The court needs an emergency order that is specific, published, and within the judge's authority.
Filing access. Open the paper drop box at the main clerk's office and at least one satellite location. Timestamp each filing and issue written receipts. Accept filings by fax or a dedicated emergency email only if the clerk can capture the receipt time and preserve the documents. Post signs at all entrances and update the phone system with a recorded message.
Self-represented litigants. The bar's warning is the key operational fact. Send notices through the public library, legal-aid offices, social-service agencies, and the court's text-alert system. Staff a phone line with at least two clerks who can explain the drop-box process. Provide language access and disability accommodations; do not make internet access a condition of filing.
Extension. A blanket 24-hour extension may exceed the administrative judge's authority and may prejudice opposing parties. Prefer an order that deems filings submitted during the outage timely if made by the next business day, or that suspends deadlines for cases affected by the outage. State the exact start and end times, preserve the original deadline for unaffected filings, and require a log of affected submissions.
Capacity. With only 12 staff and three trained in cybersecurity, assign one lead for filing operations, one for public communication, and one for vendor contact. Do not let the same person handle both the cyber incident and the public counter.
2. What should the court do about breach notification and the shared identity-management provider? Explain the 72-hour clock and the vendor's role.
Read the worked answer
Treat the incident as a potential breach until the vendor proves otherwise. The 72-hour reporting requirement is triggered by a breach involving confidential data, not by certainty that data was accessed. The court cannot wait indefinitely for the vendor's confirmation; it must start the clock when it has reason to believe confidential data may be involved.
Immediate steps. Notify the state supreme court's designated security contact or CIO within 72 hours, documenting what is known, what is not known, and the containment steps. Preserve logs from the portal, the website, and the identity provider. Do not let the vendor wipe or rebuild systems before forensic images are taken. Require the vendor to provide a written incident report, the scope of the subcontractor's access, and the data categories potentially affected.
Identity-management link. The remote hearing platform uses the same identity provider. Disable single sign-on for remote hearings or switch to a temporary alternate authentication method until the provider is cleared. Do not assume the platform is safe because it is separate; shared identity is a shared risk.
Vendor management. The SLA credits are not the priority. Invoke the security-incident terms, demand expedited forensic support, and put the vendor on written notice of potential claims and preservation obligations. Escalate to the vendor's security officer, not only the account manager. If the vendor cannot confirm data access, the court should notify affected persons conservatively and explain the uncertainty.
3. How would you communicate with the public and the bar without creating panic or misinformation? Include accessibility and trust measures.
Read the worked answer
Use a single, authoritative page and repeat the same message across channels. The message should state what is unavailable, what alternative filing methods exist, what deadline relief applies, and when the next update will come. Avoid technical jargon and avoid blaming the vendor before facts are confirmed.
Channels. Post on the court website if available; otherwise use the county's website, social media, local legal-aid listservs, the bar association, and a recorded phone message. Ask the bar to distribute the notice to members and to self-represented litigants. Place paper notices at the courthouse, library, and public assistance offices.
Accessibility. Provide the notice in the county's major languages, in plain language, and in a format screen readers can use. Include a TTY or relay number and state that disability accommodations are available. Do not rely only on social media.
Trust measures. Give fixed update times, such as noon and 5:00 p.m., even if there is no new information. Separate confirmed facts from unconfirmed reports. Explain the emergency order in plain terms and give examples. Designate one spokesperson. Do not disclose confidential security details that could increase risk. After the incident, publish a short after-action summary describing what happened, what changed, and how the public will be notified next time.