**MEMORANDUM** **To:** Board of Directors, Alderpoint Benefits **From:** Outside Counsel **Re:** Ransomware Incident — Immediate 72-Hour Response and 45-Day Plan **Date:** Saturday morning --- ## I. Executive Summary Alderpoint has a statutory breach notification event for both data sets, and the notification clocks are already running: - The **employee HR spreadsheet** is the subject of **actual acquisition** because the attackers posted a proof pack containing it. - The **participant database** is treated as acquired because firewall logs show 9 GB exfiltrated to a foreign IP and the participant database audit log shows an unusual query from a compromised administrator account at the same time. The CEO’s draft customer email may **not** be sent as written. It contains false and dangerous statements. The forensic investigation must be restructured if Alderpoint wants work-product protection. The company should not pay a ransom in the next 72 hours, and no payment should be made without sanctions screening and insurer consent. The server reimaging must stop now. The incident must be disclosed to the acquirer before signing. --- ## II. Acquisition and the Notification Clocks ### A. Employee HR spreadsheet — actual acquisition The proof pack includes an HR spreadsheet containing names and Social Security numbers of Alderpoint’s 3,100 employees. This is **direct evidence** that personal information was acquired by an unauthorized actor. - The employee spreadsheet contains “name plus Social Security number,” which is protected personal information. - There is a reasonable likelihood of harm because SSNs were exposed and posted to a leak site. - Alderpoint must notify affected employees without unreasonable delay and no later than 45 days after determination. - The regulator notice will also be required for the employee data because 3,100 employees almost certainly include 500+ residents of at least one state. ### B. Participant database — reasonable likelihood of acquisition The participant database was not encrypted, but acquisition does not require encryption. The supplied rule says acquisition includes exfiltration shown by direct evidence **or by a reasonable likelihood inferred from access, staging, or transfer indicators**. Here: - Firewall logs show 9 GB outbound to a foreign IP between 10:05 and 11:20 p.m. - The participant database audit log shows an unusual query at 10:12 p.m. from a compromised administrator account — during the same window. - The logs do not identify which files moved, but that is not fatal. The access and transfer indicators create a reasonable likelihood that participant data was acquired. For notification purposes, Alderpoint should treat the participant database as within the breach. If the exact records queried cannot be identified, the affected pool may need to be the entire participant database — as many as 1.9 million individuals — because Alderpoint cannot rule out access to all of it. ### C. When does “determination” occur? “Determination” does not mean a formal board vote or completion of forensics. It occurs when Alderpoint knows, or reasonably should know, facts sufficient to conclude that unauthorized acquisition has occurred or is reasonably likely. On these facts, determination likely occurred: - For the employee spreadsheet: when Alderpoint confirmed the proof pack contained the HR file — possibly Friday night or Saturday morning. - For the participant database: when Alderpoint reviewed the firewall and audit logs — at the latest Saturday morning. Do not delay by saying “the investigation is ongoing.” The clocks are running. The 72-hour regulator clock is running. The 45-day individual notice clock is running. Alderpoint should act as if both started no later than Saturday. --- ## III. Notice Sequencing: Regulator, Insurer, Clients, Individuals ### A. Insurer — immediately The policy requires notice “as soon as practicable.” Alderpoint should notify the cyber insurer immediately, likely before the regulator notice. The insurer also must give **written consent before any ransom payment**. Alderpoint should also confirm the panel counsel and panel forensics requirements and cooperate without waiving privilege. ### B. Regulator — within 72 hours after determination Because employee data and participant data each clearly affect more than 500 residents, Alderpoint must notify the relevant state regulator(s) within 72 hours after determination. - The notice should cover both the employee HR spreadsheet and the participant database. - Alderpoint should not wait for final forensic results before filing. - If new information later becomes known, Alderpoint should file a supplemental notice. Assuming determination occurred by Saturday, the regulator notice should be filed as soon as possible, and in any event before the 72-hour deadline expires. ### C. Employer clients — before public/individual participant notices Alderpoint has contractual and common-law duties to notify its 240 employer clients, separate from statutory individual notices. Alderpoint should notify clients whose participant data may have been involved. If the participant database query cannot be scoped, Alderpoint may need to notify all 240 employer clients that their participants’ data may have been affected. The client notice must be accurate. It cannot say “there is no evidence any data was accessed.” Typical allocation: - Employer clients, as plan sponsors and data owners, usually are responsible for sending participant notices. - Alderpoint, as the service provider, is usually required to notify the client promptly and provide enough information for the client to notify participants. - If contracts assign participant-notification duties to Alderpoint, Alderpoint may send notices on the client’s behalf, but only after coordinating with the client. - Alderpoint should also confirm that client notices are actually sent, and if a client refuses or fails, Alderpoint should escalate and consider whether it must send participant notices itself to satisfy its own legal duties. To manage 240 clients without chaos: - Designate one client-notification team and one outside-counsel coordinator. - Do not let account managers send ad hoc notices. - Map clients to affected data and contractual notice deadlines. - Use a template client notice, with limited client-specific customization, approved by counsel. - Provide a secure client portal with the notice, FAQ, call-center information, and draft participant notice. - Track all client notices and participant notices in a matrix. - Do not send the CEO’s draft email. ### D. Affected individuals — within 45 days, but sooner is better The statutory maximum is 45 days after determination, but the leak-site posting makes this urgent. Alderpoint should not use the full 45 days if it can responsibly send notices sooner. - **Alderpoint employees:** Alderpoint should prepare the employee notice now and send it as soon as addresses and notice content are ready. - **Participants:** Alderpoint should coordinate with employer clients and provide draft participant notices, data, call-center support, and credit-monitoring offers. The 45-day clock is a deadline, not a waiting period. Because the attackers have already posted the HR spreadsheet, “without unreasonable delay” likely requires faster action. --- ## IV. CEO’s Draft Email The proposed email: > “We experienced a brief encryption event. There is no evidence any customer data was accessed.” This email is inaccurate and should not be sent. ### Statement-by-statement analysis **“We experienced a brief encryption event.”** This is misleading. Alderpoint experienced a ransomware attack that encrypted a majority of its file servers. There is no basis to call it “brief.” This was unauthorized encryption and likely involved data exfiltration. Describing it as a “brief encryption event” minimizes a material incident. **“There is no evidence any customer data was accessed.”** This is false. There is actual evidence: - A proof pack containing an HR spreadsheet and client contract PDFs was posted to a leak site. - Firewall logs show a 9 GB outbound transfer. - The participant database audit log shows an unusual query from a compromised administrator account. Even if “customer data” means participant data, Alderpoint cannot truthfully deny that evidence exists. ### Liability created by sending it Sending the email would create serious exposure: - Misleading statements to clients could support claims for fraud, negligent misrepresentation, and breach of contract. - It may violate state consumer-protection or deceptive-practices laws. - It could cause employer clients to delay their own participant notifications, increasing harm. - It will be discoverable in later litigation and used against Alderpoint as evidence that it knew or should have known about the breach. - It could prejudice insurance coverage and acquirer due diligence. ### Redraft A defensible replacement for the two sentences would be: > “We recently experienced a ransomware incident that encrypted a majority of our file servers and involved the apparent removal of some files by an unauthorized third party. We are investigating the scope of the incident, and we will provide legally required notices as the investigation continues.” This version does not overstate, does not deny known evidence, and does not promise false reassurance. --- ## V. Structuring the Forensic Engagement for Work-Product Protection The forensic report will be protected only if it was prepared **primarily because of anticipated litigation**. Reports prepared in the ordinary course of incident response, or for dual business purposes like remediation and customer assurance, are ordinarily discoverable — even if counsel retained the examiner. ### What Alderpoint must do - Retain the forensic firm through counsel. - Use a litigation-specific retention letter stating that the investigation is being conducted to assist counsel in providing legal advice and in anticipation of litigation. - Direct the forensic firm to report to counsel, not to the CEO, IT, or the board directly. - Do not instruct the firm to “run the investigation like always.” - Do not “copy the IT team” with the forensic report. - Use the forensic findings for legal analysis and not as the basis for client assurance or public communications. - If Alderpoint needs a business-facing summary for clients or the board, create a separate non-privileged summary from the underlying facts. Do not use the privileged report for that purpose. ### The prior relationship issue The forensic firm has done routine security assessments for Alderpoint for years. That is not automatically disqualifying, but it cuts against work-product protection. Courts may view the work as ordinary course if the same firm does the same type of work. To improve protection: - Use a different team within the firm, if possible. - Use a new engagement letter that makes the litigation purpose clear. - Do not label the work as a “security assessment” or “incident response” in the ordinary sense. - If practical, consider a different forensic firm for the litigation-directed investigation and allow the incumbent firm to continue ordinary remediation work separately. ### Insurer panel forensics The insurer requires panel forensics. That does not automatically destroy work-product protection, but it creates risk. - The panel forensic firm should still be engaged through Alderpoint’s counsel. - Alderpoint should ask the insurer to enter a confidentiality/common-interest agreement. - The insurer should not direct the investigation or receive the full forensic report unless necessary. - If the insurer demands the report as a condition of coverage, Alderpoint may have to balance coverage against privilege. A better path may be to provide the insurer with a coverage summary or redacted factual report rather than the full privileged forensic report. --- ## VI. Ransom Decision ### Paying a ransom is not automatically unlawful Under the supplied law, payment is not itself unlawful unless the payment is made to a sanctioned person or jurisdiction. But Alderpoint must: - Conduct sanctions screening before any payment. - Screen the wallet address, threat actor communications, negotiators, and any payment intermediaries. - Use sanctions counsel or experience. - Document all due diligence. - Understand that liability is strict — Alderpoint does not need to know the recipient was sanctioned to face penalties. ### Insurer consent The policy requires **written consent before any ransom payment**. Alderpoint must obtain that consent before paying. If it pays without consent, it risks losing coverage. ### Board recommendation: do not pay in the next 72 hours Unless there is an immediate ransom deadline and no other option, Alderpoint should not pay now. The company has backups for four of six affected servers. The forensic investigation may determine that restoration from backups is possible. If the board later decides to consider payment, it should: - Engage a professional ransom negotiator and counsel. - Coordinate with law enforcement. - Obtain insurer consent in writing. - Complete sanctions screening. - Not allow the CEO or IT staff to negotiate directly. - Not announce any payment decision publicly. ### What payment does and does not buy Given the proof pack was already posted, payment **cannot buy secrecy** and **cannot undo the breach**. It may buy: - A potential decryption key. - Possibly a promise not to leak additional data. But those promises are unenforceable. Payment does **not** buy: - Immunity from notification obligations. - Deletion of data already posted. - Protection from lawsuits, regulatory fines, or acquirer claims. - Any guarantee that the attackers will not re-extort Alderpoint. The notice obligations and acquirer disclosure obligations continue regardless of payment. --- ## VII. Server Reimaging and Preservation The system administrator’s decision to wipe and reimage six infected servers was a serious mistake. From the moment Alderpoint anticipated litigation — likely when the ransomware was discovered — Alderpoint had a duty to preserve evidence. ### Consequences - Local logs from those six servers were destroyed. - Alderpoint may be unable to prove what data was accessed or exfiltrated from those servers. - In litigation, the reimaging could support an adverse inference or spoliation sanction. - It also undermines Alderpoint’s ability to give complete information to regulators, clients, insurers, and the acquirer. ### Immediate remediation - **Stop all further reimaging and wiping now.** - Preserve the current state of any affected systems before remediation. - Preserve and copy all backups for the four servers for which backups exist. - Do not restore the backups directly into production until forensic copies are made. - Preserve firewall logs, domain controller logs, audit logs, endpoint logs, SIEM data, and email logs. - Preserve the ransom note, leak-site link, and proof pack without opening files in a normal environment. - If systems must be brought back online, image them first, restore from clean backups, and change all credentials. The attack may still be active. Alderpoint should assume the attacker has credentials and persistence until proven otherwise. --- ## VIII. Disclosure to the Acquirer The acquisition agreement’s diligence certificate requires disclosure of: > “any security incident reasonably likely to result in material liability.” This incident is reasonably likely to result in material liability. The data includes: - 3,100 employee SSNs in a public proof pack. - Up to 1.9 million participant records with SSNs, dates of birth, and health-plan enrollment data. - 240 employer clients. - Potential class-action, regulatory, and contractual exposure. Alderpoint must disclose this incident **before signing**. It should not wait until the last minute or until the forensic investigation is complete. The certificate will be false if signed without disclosure. The board should: - Notify M&A counsel immediately. - Prepare a disclosure schedule describing the incident. - Disclose that the investigation is ongoing. - Plan to update the buyer before signing if more facts are learned. - Not assume that work-product protection permits omission of the underlying facts. Privilege may protect the forensic report, but not the fact of the breach or the material facts known to Alderpoint. --- ## IX. 72-Hour Priority Action List In priority order: 1. **Preserve evidence.** Stop all reimaging, wiping, and destruction of logs. Issue a litigation hold. 2. **Retain outside counsel and engage forensics through counsel.** Use a litigation-directed engagement structure. 3. **Notify the cyber insurer.** Give notice as soon as practicable and confirm panel requirements. 4. **Assume determination occurred.** Treat the regulator 72-hour clock and the 45-day individual notice clock as running now. 5. **Prepare and file regulator notice(s)** within 72 hours after determination, covering the employee spreadsheet and the participant database. 6. **Do not send the CEO email.** Prepare an accurate internal and external communication plan. 7. **Notify employer clients** in a coordinated, controlled manner, with approved templates and a secure portal. 8. **Begin preparing employee notices** and draft participant notices. Send employee notices as soon as practicable. 9. **Review the compromised administrator account and contain active threats,** but do not destroy evidence in the process. 10. **Involve M&A counsel and prepare acquirer disclosure** before signing. --- ## X. 45-Day Plan During the next 45 days, Alderpoint should: 1. Complete forensic identification of what data was accessed and, where possible, which participant records were involved. 2. Send individual notices to affected employees and participants **no later than 45 days after determination** — but sooner if feasible, especially because of the leak-site posting. 3. Coordinate all participant notices with employer clients and track completion. 4. Provide credit monitoring and call-center support to affected individuals. 5. File supplemental regulator notices if the scope expands. 6. Restore systems from clean backups and complete security remediation. 7. Resolve the ransom decision, if any, only after sanctions screening and insurer consent. 8. Disclose the incident to the acquirer before signing and update the certificate as facts develop. 9. Preserve all evidence and cooperate with law enforcement. 10. Prepare for regulatory inquiries, litigation, and insurance coverage issues. The next 72 hours will set the tone for everything that follows. Alderpoint should prioritize preservation, accurate notice, and not making false public statements.