Ransomware at Market Open
At 09:12 on a Monday, a ransomware alert fires at a mid-sized brokerage with 38,000 retail client accounts. The order management system is encrypted; the client portal still displays positions but order entry is down. The exchange opens at 09:30. The CISO finds a leaked administrator credential and a ransom note demanding 2 BTC within 48 hours. Backups exist but the last restore test was 14 months ago. The head of trading wants to switch to a manual spreadsheet-based order channel and keep trading. The CEO wants to tell clients 'no data was compromised' because the forensic review is incomplete. The regulator's incident line is open; the firm's policy says 'notify material incidents without undue delay.' A board director asks whether paying the ransom is faster. Two institutional clients have already called asking why their orders are rejected.
1. What should the firm do in the first 60 minutes, including whether to keep trading manually?
Read the worked answer
The first 60 minutes should prioritise containment, evidence preservation and controlled continuity, not speed alone.
Immediate actions:
- Activate the incident response plan and convene the crisis team: CEO, CISO, COO, compliance, legal, operations and communications.
- Isolate affected systems and disable the leaked administrator credential. Preserve logs and forensic images before rebuilding.
- Do not pay the ransom as an immediate fix. Payment carries sanctions, AML and criminal-proceeds risk, funds the attacker and does not guarantee recovery.
- Notify the exchange and regulator through the incident line without undue delay, starting with a factual holding statement.
- Keep trading manually only if all of the following are true: pre-trade limits and client-order checks work, dual control and reconciliation are in place, and the exchange/regulator has been told. A spreadsheet channel without those controls creates mistaken orders, unauthorised trading and client-money risk.
- If manual controls are not demonstrable, suspend new order entry and tell clients clearly.
The CEO should not say 'no data was compromised.' The correct statement is that the investigation is ongoing and the firm will update clients when facts are confirmed.
2. How should the firm communicate with clients and the regulator while the forensic review is incomplete?
Read the worked answer
Communication should be timely, factual and consistent across clients, regulator and staff.
To the regulator:
- Report what is known: affected systems, time of detection, client accounts potentially exposed, continuity steps and containment actions.
- State what is not yet known and give a next-update time.
- Do not speculate about root cause or data exfiltration.
To clients:
- Tell them order entry is disrupted, what channel is available and what they should not do, such as resending orders through multiple channels.
- Avoid false assurance. If breach notification may be required, say the firm is investigating whether personal data was accessed.
- Give institutional clients a named contact and a status update schedule.
Internally:
- Brief staff on a single script so salespeople do not invent explanations.
- Log all client calls and complaints.
A key judgement is that incomplete forensics is not a reason to delay a material-incident notification. It is a reason to describe uncertainty accurately.
3. What should the post-incident review cover, and what should the board decide about the ransom demand?
Read the worked answer
The board should formally decide not to pay unless legal and law-enforcement advice identifies an exceptional, lawful path. The decision should be minuted with reasons: sanctions exposure, uncertain decryption, attacker financing and the risk of repeat extortion.
The post-incident review should cover:
- How the administrator credential leaked and why it gave broad access.
- Why the backup restore had not been tested for 14 months and whether recovery time objectives were realistic.
- Whether manual trading controls were genuinely usable under stress.
- Detection and escalation delays between 09:12 and the crisis team.
- Client communication quality and complaint volumes.
- Regulatory notification timing and completeness.
- Third-party and cloud dependencies.
Board decisions should include mandatory MFA, least-privilege access, network segmentation, tested restore exercises, a manual-trading playbook and a tabletop exercise with the exchange. The board should also review whether the CEO's initial 'no compromise' instinct reflects a culture problem that needs correcting.