Data Breach at Crestline Pensions
Crestline Pensions Ltd administers retirement savings accounts for 86,000 contributors. On Friday 6 September 2024 an administrative officer in the benefits unit clicked a link in an email that mimicked a PenCom circular; attackers used the session to download 12,400 contributor files containing names, dates of birth, RSA PINs, bank verification numbers and scanned utility bills. The IT manager isolated the laptop but did not disable the account until Monday. The chief information officer wants to wait until the forensic report is complete in three weeks before telling the regulator, arguing that disclosure will trigger reputational damage and a wave of complaints. A call-centre agent has already told a contributor that there was a small IT issue. The company secretary learns that the incident log is incomplete and that a similar phishing attempt in June was not escalated. The board meets in 48 hours.
1. Advise the company on its regulatory notification and reporting obligations, including timing and recipients, and evaluate the CIO's proposal.
Read the worked answer
The data includes BVN, bank details and scanned identity documents, so the breach is likely to result in a high risk to data subjects. Under the Nigeria Data Protection Act 2023, Crestline must notify the Nigeria Data Protection Commission within 72 hours of becoming aware of the breach, and must notify affected individuals without undue delay where the risk is high. The notification should describe the nature of the breach, the categories and approximate number of data subjects, the likely consequences, the measures taken and a contact point. It can be updated as facts emerge.
As a pension operator, Crestline should also report to PenCom under its cybersecurity and data-management requirements and licence conditions, and consider NIBSS or CBN engagement if BVN misuse is possible. If the company is listed, consider NGX and SEC disclosure obligations; report to the police or EFCC for the criminal intrusion; and check contractual notification duties to clients.
The CIO's proposal is wrong. The 72-hour clock started on Friday, not when the forensic report is finished. An initial notification based on known facts, with a commitment to update, is the correct approach. Waiting three weeks risks fines, regulatory sanction, loss of trust and an allegation of concealment. The call-centre disclosure means partial information is already public, so consistency is essential. The board should authorise notification, appoint an incident lead and minute its decisions.
2. Design the incident response from discovery to closure, including board oversight, communications and evidence preservation.
Read the worked answer
Contain: disable the compromised account, reset credentials, revoke active sessions, block the sender domain and isolate affected devices. Preserve the laptop image and logs before cleaning; the IT manager should not wipe evidence. Assess: scope, data categories, number of data subjects, exfiltration path and whether the data has been used.
Notify: NDPC within 72 hours, PenCom, affected individuals and the police as appropriate. Communicate through a holding statement, call-centre scripts and an FAQ; avoid speculation and do not blame the employee publicly. Remediate: multi-factor authentication, phishing-resistant login, email filtering, least privilege, segmentation and data-loss prevention. Recover: restore services, monitor for misuse and consider credit or identity monitoring if feasible. Review: root cause, lessons learned, updated incident response plan and a board tabletop exercise.
Board oversight: daily reporting until contained, then weekly; a single accountable executive; a written decision log; and a closure report to the audit and risk committee. Evidence: chain of custody, forensic image, incident timeline with timestamps, and records of who accessed what. The board should also receive the regulatory correspondence and the remediation budget.
3. What governance weaknesses does this incident reveal, and what changes would you recommend to the board?
Read the worked answer
Weaknesses: the incident log is incomplete; the June phishing attempt was not escalated; one IT manager held both containment and communication decisions without a clear trigger; there is no tested incident response plan; the DPO or privacy function was not visibly involved; and the CIO preferred reputational protection over legal duty. The culture rewarded silence rather than escalation.
Recommendations: a board-approved incident response policy with a severity matrix and a 24-hour escalation trigger to the CEO, company secretary and board chair; a designated data protection officer and a cross-functional incident team; annual board tabletop exercises; and a standing board report on cyber key risk indicators, including phishing click rate, patch compliance, access reviews, vendor incidents and training completion. Internal audit should review cyber controls independently. Third-party assurance should cover key administrators and hosting providers. A confidential channel should allow staff to report concealment without fear. The board should also approve a communications protocol so that call-centre staff do not improvise. Finally, the audit committee should track closure of the forensic recommendations and report to the full board quarterly.