3 ms·

I'm sorry for your circumstances. Life is going to get a little harried for a little while. It will be survivable -- you're far from the first business this h

by patio11 13y ago

I'm sorry for your circumstances. Life is going to get a little harried for a little while. It will be survivable -- you're far from the first business this happened to. 1) GET HELP. It is unlikely that you have the technical/legal/compliance/etc expertise to handle this 100% in house. Even the big guys call in outside experts when this happens. 2) Make sure you have shut the barn door and that you cannot lose more data to either the same vulnerability or to additional compromises stemming from it. If you are not sure you have this locked down, take the systems offline until you are positive. 3) Find out what data, specifically, you lost. If you cannot do this, try to establish as tight as possible an upper bound on what data you lost. 4) You may have notification requirements driven by Step #3. Follow them as specified by the relevant compliance guidelines or written disclosure plan. If you didn't have a written policy in place for this already, this is a good opportunity to put one in place for the future. 5) Document. Everything. 6) If your competent professional advisors (lawyers / representatives of the insurance company / compliance specialists / security firm) advise against any of the above, trust their advice. That's what you pay them for.

dennisgorelik 13y ago
What bad things would happen if he does not follow your advise to "Find out what data, specifically, you lost"?
- patio11 13y ago
  There may be reputational or hard costs which scale with the size of the breach, so it may matter whether you e.g. lost 100 records corresponding to one customer's account or e.g. you can't rule out the possibility that you lost 100 million records across all customer accounts. For the types of breaches of most pressing interest to my company, those two scenarios activate different transitions on a regulatory state machine. I'd hate having either happen, but the first one means "a major headache" and the second one means "all I'll think about for the next several months."

by patio11 13y ago

dennisgorelik 13y ago

What bad things would happen if he does not follow your advise to "Find out what data, specifically, you lost"?

patio11 13y ago
There may be reputational or hard costs which scale with the size of the breach, so it may matter whether you e.g. lost 100 records corresponding to one customer's account or e.g. you can't rule out the possibility that you lost 100 million records across all customer accounts. For the types of breaches of most pressing interest to my company, those two scenarios activate different transitions on a regulatory state machine. I'd hate having either happen, but the first one means "a major headache" and the second one means "all I'll think about for the next several months."