Halstead & Prior LLP: A Cloud Contract and a Six-Hour Mailbox Breach
Halstead & Prior LLP is a 40-person accounting firm with 12 partners, an aging on-premises file server, and about 9,000 client tax files containing Social Security numbers. The managing partners have chosen a SaaS document platform. The vendor's draft contract allows the vendor to use aggregated data to improve services, promises 99.5% uptime, caps total liability at three months of fees (about $4,200), and disclaims consequential damages. In March an accounts-payable clerk entered credentials on a lookalike login page; the attacker had mailbox access for six hours before the help desk reset the account, and that mailbox held 60 client returns. The firm's state requires notice to affected individuals without unreasonable delay, and the firm has never written a breach notice. One partner wants to sign the contract Monday and say nothing until more is known; another wants to stay on-premises indefinitely.
1. Recommend three changes to the vendor contract before signing, and explain the business risk each one mitigates. Rank them by how hard you would push.
Read the worked answer
- Delete or narrow the data-use clause. Limit it to de-identified, aggregated data, ban re-identification, and require written consent before client content is used for product development or model training. Risk mitigated: tax data used by a third party is a confidentiality breach the firm must disclose and defend, and it may violate professional confidentiality rules independent of any statute.
- Raise and restructure the liability cap. Three months of fees (~$4,200) is trivial against a breach touching 9,000 files. Seek a separate super-cap for confidentiality and security breaches (roughly $1–2 million), and carve out third-party claims, regulatory penalties, and notification and credit-monitoring costs from the consequential-damages disclaimer. Risk mitigated: the firm bears the loss that the vendor's controls caused.
- Add security, audit, and exit terms. Enforce MFA for all access, encrypt data in transit and at rest, require vendor notice to the firm within 24–48 hours of a breach, demand an annual SOC 2 Type II report, and guarantee a complete data export plus certified deletion on termination. Raise the 99.5% uptime figure (about 3.6 hours of downtime a week) and add service credits and a termination right for chronic failure.
Ranking: data ownership and liability are non-negotiable; uptime and credits are negotiating currency. A vendor that will not move on the first two is not a viable partner for client tax records.
2. Advise the firm on its notification obligation for the March incident, and outline the client message: who signs, the channel, the content, and what to avoid.
Read the worked answer
Analysis. Names plus Social Security numbers in a mailbox that was accessed is generally a reportable breach. Without unreasonable delay means days, not months, and many states also require attorney-general notice above a threshold. Do not wait for the full forensic report to start: notify the cyber insurer, contact law enforcement, preserve mailbox and sign-in logs, and begin drafting. The short six-hour window does not create a safe harbor, and the firm should not rely on an absence of observed misuse.
Who signs: the managing partner or the designated privacy lead - not IT.
Channel: a letter or secure email to each of the 60 affected clients, plus a phone call to the largest clients; an internal FAQ so every staff member tells the same story.
Content: what happened and when, what data was involved, what the firm has done and is doing, what the client should do (including a credit-monitoring offer), and a named contact with a direct number.
Tone: plain, accountable, no jargon, no minimizing.
Avoid: speculating about the attacker, blaming the clerk by name, leading with no evidence of misuse, promising that nothing will happen, and admitting legal fault. Do not send it before outside counsel has reviewed it.
3. Which controls would most reduce the chance of a repeat, and how would you measure whether staff security training actually worked?
Read the worked answer
Controls, in priority order.
- Phishing-resistant MFA (FIDO2 keys or passkeys) on email and the document platform, plus conditional access so a login from a new location forces re-authentication. The incident began with a credential-phishing page; MFA is the direct control.
- Mailbox-level protections: external-sender banners, blocking of auto-forwarding rules to external addresses, and alerts on mass downloads or new inbox rules - the standard exfiltration path once a mailbox is open.
- Short, frequent simulation training with follow-up coaching for repeat clickers, rather than one annual video.
Measuring training. Completion rates prove nothing. Track, over 90 days: click rate, credential-entry rate (the behavior that actually caused this incident), and report rate and median time-to-report (target under 10 minutes). Also track MFA enrollment, which should reach 100%.
Do not overlook the help desk. Six hours of mailbox access suggests no anomalous-login or impossible-travel alerting fired. Verify that detection exists before attributing the incident to the clerk, and measure time from report to account reset as a control metric in its own right.