The Cyber Breach and the Silent Risk Committee
Serendib Leisure PLC operates 14 hotels and is CSE-listed. In August a ransomware attack encrypted the reservation system and exposed 120,000 guest records, including passport numbers. The CRO had resigned in May and was not replaced; the board risk committee last met in November of the previous year. The IT manager told the CEO on 3 August; the CEO decided not to disclose until the forensic report was complete. A newspaper reported the breach on 15 August; the CSE queried the company. The company's disclosure on 16 August said 'no material impact' without evidence. The share price fell 11%. The board's annual report says the board 'has a robust risk management framework and reviews cyber risk annually'. A major institutional investor has requested a meeting with the chairman and the risk committee chair. The company's external auditor has flagged the going concern of a subsidiary.
1. Assess the board's risk governance and the CEO's disclosure decision.
Read the worked answer
The board had no CRO from May, and the risk committee had not met for about nine months. Cyber risk was treated as an annual paper exercise despite 14 hotels and 120,000 guest records. That is a failure of risk governance: the board must set risk appetite, receive regular risk reporting, and ensure the risk function has authority. The CEO's decision to wait for a complete forensic report is understandable operationally but dangerous legally. CSE listing rules require immediate disclosure of material information; a ransomware attack affecting 120,000 records and systems is likely material. The 16 August statement that there was 'no material impact' was made without evidence and may be misleading. The delay and the newspaper report suggest the company lost control of the narrative.
2. What immediate and longer-term actions should the board take, including stakeholder communication?
Read the worked answer
The board should convene immediately, appoint an interim CRO or crisis lead, and establish a response team with IT, legal, communications and external forensics. It should make an accurate, timely market announcement, correct the earlier statement if needed, and notify the CSE/SEC and other regulators as required. It should assess legal and data protection obligations, notify affected guests and banks, and preserve evidence.
Longer term, the board should adopt a cyber risk framework, test incident response, report cyber risk to every risk committee meeting, and commission an independent review. The audit committee should review the incident and the external auditor's going-concern flag at the subsidiary together; both are risk signals. Stakeholders include guests, employees, insurers, lenders and regulators, not only shareholders.
3. How should the board handle the institutional investor and the annual report statement?
Read the worked answer
The chairman and risk committee chair should meet the institutional investor promptly and give a factual account: what happened, what was known when, what the board has done, and what governance changes are planned. They should not hide behind the annual report wording. The statement that the board has a 'robust risk management framework' and reviews cyber risk annually is difficult to defend when the risk committee did not meet and the CRO post was vacant.
The board should correct or qualify the statement in the next report and explain remedial action. Investor engagement should include minutes and a follow-up letter. If the investor requests a board seat, the board should consider it through the nomination process, not dismiss it. Transparency now is more credible than defending an indefensible statement.