Breach Notification When Forensics Are Inconclusive
A national retailer suffers a breach. An analyst's laptop is stolen from a car. The laptop is encrypted, but an unencrypted CSV containing 18,500 customer records was in the analyst's home directory. The records include names, addresses, and loyalty numbers; 2,100 customers are in California, 900 in Colorado, 300 are EU residents, and the rest are in states without a general breach notification statute. The payment processor contract requires notice within 72 hours of confirmed unauthorized access. Forensic analysis is underway; by day three, the retailer has confirmed the laptop was accessed but cannot yet determine whether the CSV was exfiltrated. Legal counsel advises waiting for complete forensics before notifying anyone. The state attorney general's office has not been contacted. The CISO wants to send notices immediately to all 18,500.
1. Map the notification obligations and recommend a timeline. Distinguish confirmed facts from assumptions.
Read the worked answer
Confirmed facts: the laptop was stolen, it was accessed, and an unencrypted CSV with 18,500 records existed on it. Unconfirmed: whether the CSV was exfiltrated or copied. The legal analysis should proceed on the confirmed facts, because most notification standards turn on unauthorized access or a risk of harm, not on proof of exfiltration.
California and Colorado residents are covered by state breach laws that generally require notice without unreasonable delay after confirmation of a breach. The retailer should prepare notices for those 2,100 and 900 residents and assess whether a risk-of-harm threshold is met. For the 300 EU residents, the GDPR supervisory authority notification is generally required within 72 hours of awareness if the breach is likely to result in a risk to rights and freedoms. Day three means that window is already at or past its limit; the retailer should notify or document why no risk is likely.
The payment processor contract requires notice within 72 hours of confirmed unauthorized access. That clock started when access was confirmed and may already have expired. The processor should be notified immediately, separate from any customer notice.
A defensible timeline: notify the payment processor now, make the GDPR assessment and notify the supervisory authority if required, prepare California and Colorado notices for release within a short defined period, and continue forensics in parallel. Do not wait for complete forensics before satisfying clear contractual and regulatory deadlines.
2. Evaluate counsel's advice to wait. What is the defensible approach?
Read the worked answer
Waiting for complete forensics sounds cautious, but it can become a violation if it extends past statutory or contractual deadlines. Forensics may never establish exfiltration with certainty, especially when the device is stolen and not recovered. Notification standards generally require a risk assessment, not proof of harm. The longer the retailer waits, the harder it is to argue that delay was reasonable.
The defensible approach is to separate the decision to notify from the decision to investigate. The investigation continues, but notification is triggered by the facts known now and the applicable legal standard. Counsel should provide a written risk assessment for each population, identifying the data elements, the likelihood of misuse, and the applicable threshold. Where notice is required, send it with the facts known and a commitment to update if forensics changes the picture. Where notice is not required, document the rationale.
The CISO's instinct to notify all 18,500 immediately is also not automatically correct. Over-notification can create confusion and unnecessary alarm, but under-notification creates legal and reputational risk. The defensible path is population-specific: notify where the law or contract requires it, assess risk for the remainder, and preserve evidence. The decision memo should record the disagreement between counsel and the CISO rather than suppress it.
3. Draft the key elements of the decision memo that the CISO should sign, including residual uncertainty.
Read the worked answer
The memo should open with the confirmed facts and the unresolved questions. It should state what is known: theft, access, an unencrypted file, and the record count by jurisdiction. It should state what is not known: whether the CSV was copied or transmitted, and by whom. Separating these prevents the memo from implying certainty it does not have.
Next, the memo should list the obligations and the assessment for each: California, Colorado, GDPR, and the payment processor contract. For each, it should state the trigger, the deadline, the decision, and the rationale. If the decision is to notify, the memo should specify the population, channel, and timing. If the decision is to defer, it should state the legal basis and the review date.
The memo should record the disagreement among counsel, the CISO, and the business. It should identify the residual uncertainty and the compensating actions: credit monitoring, fraud monitoring for loyalty accounts, device encryption enforcement, data minimization, and a ban on local unencrypted files. It should assign owners and dates.
Finally, the memo should state what would change the decision: recovery of the device, forensic evidence of exfiltration, or a regulator inquiry. The CISO's signature should mean the decision is documented and defensible, not that all uncertainty has been eliminated. A good memo shows the reasoning and the tradeoffs.