## Q16 key (Ransomware Weekend)
1. Employee spreadsheet: acquisition is established (posted on the leak site); the individual-notice and, on the numbers, regulator clocks run from determination, which on these facts is now, not weeks away. Missed: statutory deadlines blown at step one.
2. Participant database: not encrypted by the attack, but the 9 GB egress plus the unusual 10:12 p.m. query session from a compromised administrator account creates a reasonable likelihood of acquisition; treat notification as presumptively required while forensics runs, and document the determination timeline. The CEO's "no evidence of access" framing is contradicted by the logs. Missed: a 1.9 million-person notice obligation is wished away.
3. Who notifies participants: the employer clients are the owners of that data; Alderpoint's duties run through contract and the service-provider rule to notify the clients promptly so their clocks can be met; build a client-notification operation (template notice, coordinated timeline, dedicated contact) rather than 240 improvisations. Missed: the clients' statutory violations become Alderpoint's liabilities.
4. Sequencing: insurer notice immediately (consent and panel provisions), regulator within 72 hours of determination for the employee population, client notifications now, individual notices within the 45-day outer bound and faster. Missed: the insurer or regulator learns late and coverage or credibility is lost.
5. The CEO email cannot go out: "brief encryption event" and "no evidence any customer data was accessed" are both false or misleading on the current record; the defensible redraft acknowledges an ongoing investigation, confirmed employee-data exposure, and possible client-data involvement, and promises dated updates. Missed: a fraud-and-estoppel exhibit is self-created.
6. Forensics: the routine firm operating "like always," copying IT, fails the primarily-because-of-litigation standard; engage panel forensics under a new counsel-directed engagement scoped to litigation advice, route reporting through counsel, and keep remediation workstreams separate. Missed: the central investigative record becomes discoverable.
7. Ransom: payment is lawful only after sanctions screening and insurer written consent, and given the leak-site posting it buys deletion promises, not containment; treat as a business decision with documented screening, not a legal fix. Missed: strict-liability sanctions exposure or wasted millions.
8. Reimaged servers: document the loss, preserve the four backups and all remaining logs and firewall data immediately, and stop further remediation-by-destruction. Missed: spoliation compounds the breach.
9. Acquirer: the incident is squarely within the diligence certificate; disclose before signing with the investigation status and notification plan. Missed: fraud exposure attaches to the sale itself.