A SaaS Processor's Late Breach Disclosure
Vantage Freight, with 3,400 staff and 22 distribution centres, outsources its transport management system to LogiCore, a SaaS provider that also handles customs filings and driver records for 61,000 carriers. On 3 March LogiCore tells Vantage that intruders accessed a storage bucket between 12 and 21 February; the provider detected the intrusion on 24 February and disclosed on 3 March, nine days after discovery. Exposed records include driver names, home addresses and licence numbers for 4,100 drivers, plus pickup and drop-off schedules for two retail customers. The master services agreement requires notice 'without undue delay and within 72 hours of confirmation'. Vantage's contracts with the two retailers require notification within 24 hours of Vantage becoming aware. The applicable state breach law requires consumer notice within 30 days of discovery. LogiCore has supplied only a summary and an assurance that 'the risk is low'. The CISO must brief the board in 48 hours.
1. When do the notification clocks start, and what would you do in the next 72 hours?
Read the worked answer
Clock analysis:
- Retail customers (contractual): Vantage became aware on 3 March. The 24-hour clause is already in breach or must be met immediately. Contractual notice is not excused by incomplete facts - it requires notice, not a final report.
- State breach law (30 days from discovery): the conservative reading is that Vantage's discovery is 3 March, giving a 2 April deadline. Whether the processor's earlier discovery is imputed is a legal question, but planning to the earlier date cannot hurt and planning to the later date can.
- GDPR-style 72-hour regulator notice: if any EU drivers are in the data set, that clock is running now and is the tightest constraint.
Next 72 hours:
- Notify the two retailers in writing today, with what is known, what is not known, and a named contact. Late and complete beats early and silent.
- Instruct LogiCore in writing to provide the affected-record list, the forensic report, containment evidence and confirmation of eradication, with a deadline and an escalation contact.
- Start the risk-of-harm assessment now. Licence numbers plus home addresses are identity-fraud enablers; 'risk is low' from the party that lost the data is an assertion, not an assessment.
- Prepare consumer notice and a call-centre script so that mailing is not the bottleneck when the data set arrives.
- Preserve Vantage's own logs of the vendor relationship - contract notices, tickets, approvals - as evidence of diligence.
2. How should this event be recorded and treated in the vendor risk process?
Read the worked answer
The event is a test of the vendor risk process, and the process is currently failing: a tier-one processor handling identity data disclosed nine days after discovery and supplied no evidence. Log it as a risk event, not an incident ticket.
Risk register entry:
- Inherent risk: high - identity data, 4,100 data subjects, regulator and retailer exposure.
- Residual risk: currently unknown and therefore high. Unknown is not low; it should be recorded as high until evidence arrives.
- Treatment: mitigate - contractual enforcement plus technical verification.
Contractual and commercial actions:
- Serve a reservation-of-rights letter so indemnity and service-credit claims are not waived by continuing to trade.
- Enforce the 72-hour clause formally; require a root-cause report and a remediation plan with dates.
- Demand evidence of controls you previously took on trust: bucket configuration review, access logging, key management, subprocessor list, and the results of the last independent penetration test.
- Invoke audit rights, or accept the vendor's most recent SOC 2 Type II only if its period covers the intrusion window - a report from before February says nothing about February.
Portfolio action: re-tier the vendor against data sensitivity rather than spend, and apply the same 72-hour and evidence obligations to the other thirteen contracts reviewed this quarter. If LogiCore refuses evidence within a defined deadline, open an exit plan; concentration risk in a single TMS provider is now a documented board-level exposure.
3. What should the board be told in 48 hours, and what decision should be asked of it?
Read the worked answer
The board briefing should separate what is known, what is unknown, what is being done, and what the board must decide. Boards tolerate bad news; they do not tolerate discovering later that the executive team concealed uncertainty.
Structure:
- What happened: dates, the nine-day vendor gap, data categories, approximate population, and the fact that no record-level list exists yet.
- What we do not know: whether the data was exfiltrated or merely exposed, whether any EU drivers are affected, whether the retailers will invoke audit rights or penalties.
- Exposure: regulatory notification duties with dates, contractual liability, reputational risk, and the possibility of a class action given licence numbers.
- Actions taken: retailer notice issued, vendor instructed with deadlines, consumer notice drafted, forensic support retained.
- Decision required: authorise immediate notification on the current facts rather than waiting for a complete data set, and authorise the spend to support it.
Framing advice: avoid presenting 'vendor says risk is low' as a mitigant. Present it as an unverified assertion being tested. Give a single number for the notification deadline so the board can hold the organisation to it, and name the executive accountable. Offer a follow-up date within two weeks with the vendor evidence or the escalation decision, so the board is not left with an open loop.