# MEMORANDUM — PRIVILEGED & CONFIDENTIAL / ATTORNEY WORK PRODUCT **To:** Board of Directors, Alderpoint Benefits **From:** Outside Counsel **Re:** Ransomware incident of Friday, [date] — 72-hour and 45-day plan **Date:** Saturday, [date] --- ## 0. Executive summary 1. **Acquisition is established, not merely likely, for the employee spreadsheet.** The 40-file proof pack is public. The names-plus-SSN combination is squarely within the statute. The only open question is the resident count, which is an HR query, not a forensic one. 2. **Acquisition is reasonably likely for participant data**, and under the supplied inference rule you should operate on that presumption today. The 9 GB outbound transfer (22:05–23:20) and the anomalous large query at 22:12 from a compromised administrator account are exactly the "access, staging, or transfer indicators" the rule contemplates. The fact that the segmented server was not *encrypted* is legally irrelevant — encryption by the attacker is not the test. 3. **You have two clocks, on two tracks, and they should not be merged.** Track 1 (employees) is running now. Track 2 (participants) starts on a determination you must make promptly and deliberately — target 10–14 days, not 45. 4. **The CEO's email cannot go out.** One sentence is unsupportable; the other is affirmatively false on facts already known. Redrafts below. 5. **The forensic engagement as the CEO proposes it forfeits all protection.** Two-track structure required; even then, plan on the report being discoverable and write accordingly. 6. **Ransom:** negotiate for intelligence and time; do not pay without documented sanctions screening and the insurer's *prior written* consent; recognize that payment buys almost nothing here because publication has already begun. 7. **The acquirer must be told this week**, before signing. The certificate cannot honestly be signed otherwise. 8. **Stop all reimaging now.** The single most time-critical preservation item is the firewall/netflow log — those retention windows are frequently 7–30 days. --- ## 1. "Acquisition": two separate analyses ### 1.1 The employee spreadsheet — acquisition is proven Rule 4 permits inference from indicators, but here you do not need inference. The attacker **published** an HR spreadsheet with the names and SSNs of 3,100 employees. That is direct evidence of both acquisition and disclosure. Reasonable likelihood of harm is not seriously arguable: SSNs on a criminal leak site are, definitionally, exposed to a population motivated to misuse them. Two verification tasks (hours, not days): - **Authenticate the proof pack.** Compare the posted spreadsheet against your HR system of record. Confirm it is your file, confirm the field set (SSN present?), confirm the record count and the as-of date. This is the factual predicate for "determination." - **Count residents.** Map the 3,100 employees to state of residence. If 500 or more are residents of this state, the 72-hour regulator clock applies. With 3,100 employees at a single-jurisdiction benefits firm, assume the answer is yes unless HR proves otherwise. **Do not treat this as a small breach because it is "only" employees.** Published SSNs of your own workforce create employment-relations exposure, a class of plaintiffs with the best-documented injury in the case, and — critically — proof that the attacker had access to sensitive file shares, which undercuts any later argument that the participant environment was untouched. ### 1.2 The participant database — reasonably likely, and you should so presume The indicators: | Indicator | Significance | |---|---| | Compromised administrator account | Means of access; also defeats access-control defenses | | Unusually large query session, 22:12 | Access + staging: data assembled into a result set | | 9 GB outbound to foreign IP, 22:05–23:20 | Transfer, temporally bracketing the query | | Attacker in file-server environment (proven) | Establishes presence and intent to exfiltrate | Under Rule 4 this is a textbook inference case: access indicator, staging indicator, and transfer indicator, aligned in time. The absence of file-level attribution in the firewall logs is a gap in *your* visibility; it is not evidence of non-acquisition, and no regulator or plaintiff will read it that way. Three points the board must understand: **(a) "Not encrypted by the attack" is not a defense.** Rule 4's final sentence cuts the other way from what management may assume: encryption by the attacker is not itself acquisition, but *the absence of encryption says nothing about whether data was taken*. The segmented database was the more valuable target and was reachable by a compromised admin account. Its survival is consistent with — indeed typical of — a deliberate exfiltrate-then-encrypt-elsewhere pattern. **(b) The at-rest encryption safe harbor is probably unavailable.** Two independent reasons. First, Rule 3 conditions the safe harbor on the key not being compromised; if the compromised administrator account held or could invoke the key, or if key material was accessible from the compromised domain, the safe harbor fails. Second, and more fundamentally: a query executed through the application returns **plaintext**. At-rest encryption does not protect against an authenticated query session. Confirm the key-management architecture, but do not build the notification plan on this. **(c) The 2 TB claim is false, but that is cold comfort.** Only 9 GB left the network. That materially undercuts the attacker's leverage and is useful in negotiation. But 9 GB is enormous in *record* terms. A participant record of name, DOB, SSN, and enrollment fields runs a few hundred bytes to a few kilobytes; 1.9 million such records are on the order of 1–4 GB raw and far less compressed. **9 GB does not exclude the entire database.** Anyone who tells the board "it's only 9 GB, so it can't be all of them" is wrong. ### 1.3 The scoping question that determines everything The forensic priority is not "was there exfiltration" — assume yes. It is **what did the 22:12 query return.** Specifically: - The database audit log's captured statement text, row count, and bytes returned; - Whether the audit configuration logs statements only or also result metadata; - Application-layer logs, query plan cache, temp table/spool artifacts, export-to-file artifacts on the DB host; - Whether the session was one query or a paginated series (common in bulk theft); - Whether the 9 GB stream can be size-matched or timing-matched to the result set. **Decision rule for the board, adopted now:** if forensics can reliably reconstruct the result set, notification scope is the individuals in that set plus any adjacent uncertainty. **If it cannot do so within 10 days, the scope is the entire participant population.** Inability to exclude, combined with strong transfer indicators, is a reasonable likelihood. Commit to that rule in writing today, because the worst version of this case is one where scoping "remains open" until day 40 and the extension conveniently coincided with the signing date. --- ## 2. When the clocks start; what "determination" means ### 2.1 "Determination" is a legal conclusion you must reach diligently "Determination that a breach occurred" is not the attacker's claim, not the first alarm, and not the final forensic report. It is the point at which the facts reasonably available to you support the statutory elements: unauthorized acquisition of personal information creating a reasonable likelihood of harm. Two abuses to avoid: - **Deferring determination.** The clock cannot be managed by declining to conclude. "Without unreasonable delay" governs the *whole* process, and a regulator reviewing a 40-day investigation of a publicly posted SSN spreadsheet will treat delay in determining as delay in notifying. Delay is also the fact pattern that converts a negligence case into a bad-faith case. - **Premature global determination.** Equally, do not announce on Saturday that 1.9 million people were breached. That is not yet supportable, is irreversible, and would be unfair to clients and participants alike. Determine what you know, when you know it, and document the basis. **Practical device: sequential, documented determinations.** Maintain a dated determination log signed by counsel and the incident commander, recording for each population: the facts, the conclusion, the date, and the clock triggered. ### 2.2 The two clocks **Track 1 — Employees (3,100).** - **Determination date: Saturday or Sunday**, upon (i) authentication of the posted spreadsheet and (ii) the resident count. There is no honest basis to push this past Monday. - **Regulator (if ≥500 residents): 72 hours from that determination** → filed by Tuesday/Wednesday. File early; a short filing that says "confirmed publication of a file containing name+SSN for 3,100 employees; participant scope under active investigation; supplement to follow" is better than a complete filing on day 4. - **Individuals: 45 days maximum, but 45 days is a ceiling, not a plan.** The data is *already public.* The harm is imminent and ongoing. Notify employees **this week** — target 5–7 days — with credit monitoring and identity restoration enrolled and live at the moment of notice. A 40-day delay on publicly posted SSNs is the paradigm of "unreasonable delay." **Track 2 — Participants (up to 1.9 million).** - **Determination date: to be set upon completion of query scoping, target day 10–14**, subject to the 10-day default rule above. - **Regulator: 72 hours from that determination**, for the resident count in scope (certain to exceed 500). - **Individuals: 45 days from that determination.** Because the population is large and multi-jurisdictional, the operational build (print/mail vendor, call center, monitoring contract, address hygiene, deduplication) must start **now, in parallel**, on the assumption of the maximum population. Do not sequence build-after-determination; you will miss day 45. **Do not bundle the two regulator filings.** Two filings, three days apart, is a compliance record. One filing on day 17 that covers both is a violation as to the first population. ### 2.3 Sequencing map **Hours 0–24 (Saturday):** Insurer notice (policy: "as soon as practicable" — today). Counsel and forensic retentions papered. Litigation hold issued. Containment and credential reset. Preservation directives, especially firewall logs. Board briefed; communications freeze imposed. **Hours 24–72 (Sunday–Tuesday):** Employee determination made and logged. Regulator filing on Track 1. Law-enforcement report (see 2.4). Client notice wave 1 (below). Negotiator engaged; sanctions screening opened. Acquirer notified. Employee notice drafted, vendor contracted. **Days 4–14:** Employee notices mailed. Participant query scoping completed; Track 2 determination made and logged; regulator filing on Track 2 within 72 hours of it. Client-by-client record identification. Notification vendor contracted at full scale. **Days 14–45:** Client-level record confirmation; template negotiation with major clients; dedupe; addresses; print and mail; call center live before mail lands; substitute notice if contact information is deficient; supplemental regulator filings as facts firm up; final forensic and remediation reporting. ### 2.4 One caution The supplied law contains **no law-enforcement delay exception**. Report to law enforcement — it is good practice, it aids sanctions screening, and it is a favorable fact — but do **not** assume a request to delay tolls anything. Absent express statutory authority, "the FBI asked us to wait" is not a defense to the 45-day or 72-hour deadlines. --- ## 3. Who notifies 1.9 million participants — Alderpoint or the 240 clients? ### 3.1 The legal allocation Rule 1 requires notice to affected individuals without specifying the sender. Rule 8 tells us that duties to notify *business customers* are **separate from and additional to** statutory individual notice. Read together: - **Alderpoint owes the statutory individual-notice duty** as the entity whose systems were breached and which holds the data. A contract with a client does not discharge a statutory obligation owed to the individual. - **Alderpoint separately owes each client contractual/common-law notice** — typically within 24–72 hours of discovery, with cooperation, forensic detail, and indemnity provisions. ### 3.2 What the contracts will actually say Pull all 240 agreements today and code them (this is the highest-value document review of the next 72 hours). Expect: - **Notice-to-client windows** — often 24, 48, or 72 hours from *discovery*, not determination. Some of these may already be running or breached. Identify them first. - **Control of individual notice reserved to the client** as plan sponsor/data owner, with Alderpoint bearing cost; - **Approval rights over content and timing**; - **Indemnity, audit, termination-for-cause, and SLA credit provisions**; - **Business-associate terms** for the health-plan enrollment data, which will impose their own notice mechanics running to the covered entity. Note for the board: the health-plan data means most clients' arrangements likely involve a business-associate relationship and ERISA plan fiduciaries. That is a parallel regime with its own timelines and its own notice content requirements, and it must be analyzed client by client alongside the statutory analysis here. Do not let the two tracks be conflated by account managers. ### 3.3 The practical answer Neither pure model works. Adopt a **default-with-opt-out**: - **Alderpoint funds and executes** notice through a single national vendor, using one master template, **co-branded to each client** and issued "on behalf of [Client Plan]." - **Any client may elect to send its own notice**, in which case Alderpoint supplies the record list, approved facts, template, and funding, and the client commits to a mailing date. - **Backstop, non-negotiable:** if a client has not mailed by **day 30** of Alderpoint's determination, Alderpoint mails. State this in writing in the first client letter. Your statutory duty is not delegable, and the day-45 wall does not move because a client's general counsel is on vacation. ### 3.4 Managing 240 clients without chaos - **Tier by exposure.** Tier 1: top ~20 clients by record count (likely a majority of the 1.9M) plus any with 72-hour contractual clocks or termination triggers — partner-level, live calls. Tier 2: next ~60 — scheduled calls on a script. Tier 3: remainder — written notice plus portal access and an office-hours line. - **Single channel, single voice.** One designated client-communications lead. **Account managers are prohibited from answering incident questions**, full stop. Everything routes to the lead. Every account manager gets a one-page "here is what you say and nothing else" card. - **Version-controlled fact sheet.** A dated "Known Facts / Under Investigation / Not Yet Known" document, revised on a fixed cadence (daily for the first week, then twice weekly). Every client gets the same version at the same time. Never let one client hold a different set of facts than another — differential disclosure is how you get a discrimination theory and a lead plaintiff. - **Assume every word is discoverable.** Every client email, call log, and portal post will be produced in litigation and reviewed by regulators. Write for that audience. No speculation, no reassurance you cannot document, no blame. - **Deduplicate before mailing.** Participants routinely appear under multiple clients. Dedupe on identity, not client, or you will send the same person four letters with four different plan names and generate both confusion and a second wave of complaints. - **Capacity, contracted now:** print/mail at 1.9M scale, call center with trained scripts and surge staffing, monitoring/restoration enrollment, address hygiene/NCOA, minors and deceased-participant handling, non-English notice where indicated, substitute-notice mechanics for populations with insufficient contact data. --- ## 4. The CEO's draft email ### 4.1 Statement-by-statement **"We experienced a brief encryption event."** Inaccurate and materially minimizing. A majority of file servers were encrypted; six servers were rebuilt from scratch; four of six lost their logs; operations are degraded and will be for some time. "Brief" describes neither the intrusion (the attacker was present long enough to stage and move 9 GB), the impact, nor the remediation. "Event" is euphemism where the accurate word is ransomware attack with extortion. A jury shown this sentence next to the ransom note infers concealment. **"There is no evidence any customer data was accessed."** **False when written.** Three independent contradictions: 1. **Client contract PDFs are in the published proof pack.** Those are customer data, and their publication is direct evidence — not merely evidence of access, but of disclosure to the world. 2. **9 GB left the network** to a foreign IP during the intrusion window. 3. **A compromised administrator account ran an anomalous bulk query against the participant database** — data held for customers — at 22:12, inside that window. This is not a defensible framing choice or an incomplete statement. It is a representation contradicted by facts in management's possession at the moment of drafting. ### 4.2 Liability created by sending it - **Deceptive-practices exposure** to state regulators, independent of the breach itself. Regulators penalize misleading breach communications more reliably than they penalize the breach. - **Fraud and negligent-misrepresentation claims** by clients who rely on it in deciding not to notify, not to investigate, not to terminate, or not to mitigate. This converts a data-security case into an intentional-tort case with punitive exposure and, potentially, no insurance coverage. - **Loss of the good-faith narrative.** Your best defense on scope uncertainty is that you investigated diligently and communicated honestly. This email destroys that defense permanently and cannot be recalled. - **Continuing duty to correct.** Once sent, every subsequent day without correction compounds the exposure; the eventual correction becomes an admission. - **Transaction contamination.** The email will land in the acquirer's data room. A false customer communication is itself a disclosure-schedule item and an independent fraud claim by the buyer. - **Personal exposure** for the CEO and for any officer who reviewed and cleared it. **Instruction: no external communication of any kind — customer, employee, press, social, or LinkedIn post — until cleared by counsel. Issue that freeze in writing today.** ### 4.3 Redraft (two sentences) > "Late Friday night, [date], Alderpoint was hit by a ransomware attack that encrypted a majority of our file servers, and we are restoring systems while a forensic firm investigates. > > The attacker has publicly posted a sample of Alderpoint files, including client contract documents, and our investigation is examining evidence of an unauthorized data transfer from our network on Friday evening; we will contact you directly with specific findings about your data as soon as we confirm them, and we will not wait for the investigation to conclude to tell you what we know." Why these work: each clause is documented; the leak-site posting and the transfer evidence are disclosed rather than concealed; scope is described as under investigation rather than resolved in either direction; and the only promise made is a promise about *process*, which you can keep. --- ## 5. Structuring the forensic engagement ### 5.1 The CEO's proposal forfeits everything "Run it like always and copy the IT team" satisfies every element of Rule 5's *non*-protection test: an engagement in the ordinary course, with a long-standing pre-existing routine relationship, dual remediation and customer-assurance purposes, and distribution to the business. Counsel's name on the engagement letter changes nothing under the supplied rule — it expressly says so. ### 5.2 Two-track structure **Track A — Business/remediation investigation (assume fully discoverable).** The incumbent firm, under its existing MSA, ordinary-course invoicing, reporting to the CIO. Scope: containment, eradication, persistence hunt, restoration, hardening, and the **factual** scoping of the 22:12 query and the 9 GB transfer. Feeds notification decisions, client and regulator communications, and insurer proof of loss. Write it accordingly: facts, artifacts, and methodology only. **No legal conclusions, no "we should have," no root-cause blame narrative, no speculation about liability or about what the attacker "probably" did.** Every adjective in a discoverable report is a future exhibit. **Track B — Counsel-directed litigation analysis.** A **different firm** (strongly preferred) or, at minimum, a walled team of different individuals under a separate SOW. Retained by counsel, on a new engagement letter reciting anticipated litigation and regulatory proceedings, with: - Scope defined as assisting counsel's legal analysis — not remediation, not customer assurance; - Deliverables to counsel only; **oral briefings preferred over written reports**; any writing marked and tightly held; - No distribution to IT, the business, the CEO's staff, or the sale process; no summarization in board minutes; - Separate invoicing coded to legal, paid from the legal budget; - A written distribution list maintained by counsel. ### 5.3 Set expectations honestly Even a clean two-track structure yields protection over **analysis at best, never facts**. Disk images, logs, IOCs, timelines, the fact of exfiltration, and the identity of affected individuals are never privileged. Anything you must tell a regulator, a client, or a court must rest on Track A facts you can produce. **Corollary, which the board should hear plainly:** privilege is not a strategy for this incident. Do not make notification decisions you would be embarrassed to defend on the assumption the reasoning stays hidden. Assume the entire investigative record becomes public. ### 5.4 The insurer's panel requirements Panel requirements are **coverage conditions**, and violating them can forfeit millions. - **Panel forensics:** using the panel firm does not itself defeat work product. But the insurer's need for information creates a business purpose and a third-party disclosure problem. Solution: obtain the insurer's written agreement that the panel firm is retained **by and reporting to counsel**; enter a common-interest/confidentiality agreement with the carrier; and satisfy the carrier with **factual** updates and Track A deliverables rather than Track B analysis wherever possible. - **Panel counsel:** get the carrier's written consent to this firm's continued role now, or associate panel counsel promptly, or accept that fees are uncovered. Resolve this in the first insurer call — today. - **Do not let panel logistics delay containment or the Track 1 determination.** Retain who you need now with a documented reservation of rights, and reconcile with the carrier within days. - Note the structural tension: the carrier's interests and Alderpoint's diverge on coverage scope and on ransom. Keep counsel's independent judgment, and paper it. --- ## 6. The ransom decision ### 6.1 Lawful preconditions Payment is lawful **unless** it goes to a sanctioned person or jurisdiction — and that exposure is **strict liability**. Intent, ignorance, insurer consent, and counsel's blessing are all irrelevant to that liability. Therefore, before any payment: 1. **Attribute.** Identify the variant, the group, the negotiation infrastructure, the leak-site branding, and known aliases and affiliates. 2. **Screen.** Run the group, aliases, wallet addresses, and any facilitator against sanctions lists using a specialist screening vendor or a payment facilitator with a documented compliance program. Screen the wallet's transaction lineage, not just the address. 3. **Report to law enforcement** before payment. This is both good practice and a mitigating fact. 4. **Document the entire diligence file** contemporaneously. 5. **Stop rule:** if screening cannot **affirmatively exclude** a designated actor or jurisdiction, **do not pay.** Ambiguity resolves against payment. Strict liability plus a large reputational overlay makes this the only defensible posture. ### 6.2 Insurer consent The policy requires **written consent before payment**. Obtain it in writing, in advance, with the negotiator and facilitator identified. Payment without consent likely voids reimbursement — and unreimbursed ransom becomes a diligence and MAE issue in the sale. ### 6.3 What negotiation buys, and what payment does not **Negotiate — yes.** Through a professional negotiator, never the CEO or IT directly. Value: - **Time**, and delay of staged publication; - **Intelligence, which is the real prize.** Demand a complete file tree or directory listing of what was taken, plus samples from the participant database if they claim it. This is the fastest available route to scoping — and if they cannot produce participant records, that is meaningful (though not conclusive) evidence bearing on your Track 2 determination; - Testing the "2 TB" claim against your 9 GB observation. That discrepancy is leverage and should be used. **Payment does not buy:** - **Deletion.** Any "proof of deletion" is unverifiable by construction. Treat exfiltrated data as permanently in criminal hands. - **Un-publication.** Forty files, including your employees' SSNs, are **already public**. That cannot be undone. This is the decisive point: the primary commercial rationale for paying — suppression — is already partly defeated. - **Any relief from notification.** The clocks are unaffected. Do not let negotiation become a reason to delay determination or notice. - **Protection from re-extortion**, which is common after payment. - **Confidentiality of the payment itself.** It is discoverable, likely reportable, and a diligence item. **Decryption need:** verify backup integrity and immutability for the encrypted file servers before valuing a decryptor. If backups restore, the decryptor is worth little. **Recommendation:** engage and negotiate for intelligence and time. Do not pay absent (i) clean sanctions screening, (ii) written insurer consent, and (iii) a specific, articulated benefit that survives the fact of publication. On these facts, that third condition is unlikely to be met. Present payment to the board as a documented business decision with counsel-reviewed diligence, and record the reasoning either way. --- ## 7. The reimaged servers: preservation and remediation ### 7.1 The problem The duty to preserve attached no later than receipt of an extortion demand — litigation and regulatory proceedings were then plainly anticipated. Six servers were wiped, destroying local logs; backups exist for only four. The wipe predates counsel's engagement and was motivated by restoring operations, which is a genuine "reasonable operational needs" argument under Rule 7 — but it is a much weaker argument for a *benefits administrator* holding SSNs for 1.9 million people, whose incident-response plan should have required imaging before rebuild. **Exposure:** spoliation motions, adverse-inference instructions, regulator findings of inadequate response, and the practical harm of investigating a lateral-movement question with two-thirds of the relevant logs gone. The two servers with **no** backup are the acute risk: if either was the initial-access or staging host, you may never be able to prove — or disprove — the scope of participant access. ### 7.2 Immediately (today) 1. **Written litigation hold**, issued to all custodians, plainly worded. 2. **Halt all further reimaging, rebuilding, disk reuse, and log rotation** pending forensic imaging. Written directive from the CEO, distributed to every IT staff member individually and acknowledged. 3. **Image the already-reimaged disks anyway.** Reimaging is not wiping; unallocated space frequently retains recoverable log fragments and artifacts. 4. **Preserve, urgently and in this order of volatility:** - **Firewall/netflow/proxy logs** — the 9 GB record is your single most important artifact and often has the shortest retention. Export and hash **today**. - **The participant database audit log**, the DB host, and its backups — do not touch that server. - SIEM/central aggregator (logs may have been forwarded before the wipe — this is the best chance of recovering what the sysadmin destroyed). - EDR cloud telemetry, retained centrally and independent of the hosts. - Domain controller and authentication logs (the compromised admin account), VPN/remote-access logs, email and cloud/M365 audit logs. - The four available backups — **suspend all rotation and retention deletion immediately**; they may contain local logs as of the last good backup. - Ransom note, negotiation channel transcripts, and **timestamped, hashed captures of the leak-site posting and the 40 files** (capture now; leak sites disappear). 5. **Contemporaneous memorandum** documenting each preservation-versus-restoration tradeoff, who decided, and why. This is the record that makes "reasonable operational needs" credible later. 6. **Interview the system administrator promptly**, counsel-led, with an Upjohn warning, factual and non-accusatory, memorialized while memory is fresh. Do not discipline anyone this weekend; do not create a scapegoat narrative in writing. You need this person's full cooperation and accurate recollection more than you need accountability theater. ### 7.3 Remediation, in parallel Assume the attacker retains access until proven otherwise. - Reset **all** credentials — the compromised admin account first, then all privileged accounts, service accounts, and Kerberos keys; revoke sessions and tokens. - Hunt for persistence before restoring anything into the domain. Do not restore clean backups into a compromised directory. - Re-verify the participant server's segmentation, and consider taking it offline or read-only until the hunt clears — it is the crown jewel and it is still standing. - Enforce MFA on all administrative and remote access; disable legacy authentication. - Enable full DB audit logging including result metadata; verify DLP/egress alerting actually alerts. - Verify backup immutability and off-domain storage. --- ## 8. Disclosure to the acquirer ### 8.1 The certificate requires disclosure The standard is "any security incident **reasonably likely to result in material liability**." That threshold is met, comfortably, on the *confirmed* facts alone: published SSNs of 3,100 employees, notification and monitoring costs, regulator filings, and client indemnity claims. With participant exposure reasonably likely across up to 1.9 million individuals — notification at scale, credit monitoring, 240 client indemnity and termination exposures, multi-jurisdiction regulatory attention, and class litigation — materiality is not a close question. **The certificate cannot be signed without disclosure.** Signing it as-is would be fraud: it typically survives closing, is excluded from indemnity caps and often from the exclusive-remedy clause, exposes the signing officer personally, may support rescission, and would very likely void coverage for the resulting claim. There is no version of this where non-disclosure is the lower-risk path — the incident will be public within 45 days by operation of law. ### 8.2 Timing and mechanics - **Notify the acquirer this week**, in writing, under the existing NDA with clean-team protocols. Ahead of, not simultaneous with, your first client wave — the buyer should not learn this from a client. - **Disclose what is known, what is under investigation, and what is not yet known**, using the same version-controlled fact sheet given to clients. Symmetry of disclosure is your protection. - **Also review interim operating covenants** — many require prompt notice of material adverse developments, litigation, and regulatory contact. That obligation may already be running independent of the certificate. - **Anticipate the buyer's asks:** diligence access, a supplemented disclosure schedule, price adjustment, a **special indemnity or escrow** sized to notification and litigation exposure, extended survival for privacy reps, MAE analysis, and possibly delay. - **Negotiating posture:** propose a schedule supplement plus a bounded special escrow. That is more achievable than either concealment or a fight over the rep itself, and it converts an open-ended fear into a quantified number the buyer can price. - **Consider proposing a short delay in signing** until the Track 2 determination is made. A three-week signing on unknown scope means signing reps you cannot support and re-cutting the deal later on worse terms. A two-to-three-week slip with an honest disclosure is usually cheaper than a post-signing fraud allegation. ### 8.3 The governance point **The deal timetable must not drive the notification timetable.** Any hint that the determination date was managed to clear signing — a scoping decision deferred to day 40, a regulator filing held for a closing, a "no evidence" email sent to keep clients quiet through diligence — turns a defensible incident-response case into a fraud case against individuals. Say this to the board explicitly, on the record, in the minutes. --- ## 9. 72-hour action list, in priority order **Hours 0–6** 1. Stand up incident command; single incident commander; counsel embedded; decision log opened. 2. **Communications freeze**, in writing, to all personnel — customers, employees, press, social media. Pull the CEO's draft email from circulation and confirm it was not sent. 3. **Halt reimaging.** Written directive to all IT staff, individually acknowledged. 4. **Preserve firewall/netflow logs, DB audit logs, EDR telemetry** — export and hash now. Suspend all backup rotation and log retention deletion. 5. **Notify the cyber insurer** ("as soon as practicable"); resolve panel counsel and panel forensics; obtain written retention consents and a reservation of rights. 6. Containment: disable/reset the compromised admin account and all privileged credentials; verify participant-server segmentation; begin persistence hunt. **Hours 6–24** 7. Retain the **Track B** counsel-directed examiner on new papers; scope **Track A** with the incumbent firm; issue the distribution-control memo. 8. **Litigation hold** issued to all custodians; capture and hash the leak-site posting and all 40 files. 9. **Authenticate the HR spreadsheet**; obtain the employee **residency count**. 10. Retain a **ransom negotiator**; open the channel for intelligence only; begin **sanctions attribution and screening**; no payment discussion authorized. 11. Pull and code all **240 client contracts** for notice windows, notice-control allocation, indemnity, BA terms, and termination triggers; flag any window already running. 12. Board briefing; ratify the determination protocol, the 10-day scoping default rule, the day-30 client backstop, and the no-payment-without-conditions rule. **Hours 24–48** 13. **Track 1 determination** made, documented, signed, and logged. 14. Prepare and file the **72-hour regulator notice** for the employee population (file early, supplement later). 15. **Report to law enforcement**; do not assume any tolling. 16. **Notify the acquirer** in writing under clean-team protocol. 17. **Client notice wave 1**: Tier 1 calls plus a uniform written notice and version-1 fact sheet to all 240. One voice; account managers scripted and restricted. 18. Draft employee notice; contract the notification vendor, call center, and credit monitoring; scope the vendor for the 1.9M contingency now. 19. Counsel-led interview of the system administrator, Upjohn warning, memorialized. **Hours 48–72** 20. Confirm the regulator filing is submitted and docketed; assign a supplementation owner and cadence. 21. **Track 2 scoping sprint**: reconstruct the 22:12 query result set; size- and time-match against the 9 GB transfer; report to counsel on a daily cadence against the day-10 deadline. 22. Verify the encryption-key posture for the participant database (Rule 3 safe-harbor analysis) and document the conclusion. 23. Verify backup integrity and restoration path; decide independently whether a decryptor has any residual value. 24. Complete sanctions screening; present the pay/no-pay recommendation to the board with the diligence file attached; obtain the insurer's written position. 25. Stand up the participant notification program office: dedupe strategy, address hygiene, template, minors/deceased handling, substitute-notice plan, call-center scripts. 26. Fix the daily rhythm: 8:00 a.m. incident command, 5:00 p.m. counsel-only privileged review, weekly board update, fact sheet versioned on a published cadence. --- ## 10. The three things the board must decide today 1. **Adopt the determination protocol** — including the 10-day scoping default that treats the full participant population as in scope if the query cannot be reconstructed. This is the single decision that most affects your regulatory and litigation posture, and it must be made *before* anyone knows whether it is convenient. 2. **Ratify the communications freeze and the redrafted language.** The CEO's email is the most dangerous document in this incident, and it has not yet been sent. Keep it that way. 3. **Direct that the sale timetable will not influence any notification date**, and record that direction in the minutes. Everything else in this memo is recoverable. That one is not.