# Question 16: The Ransomware Weekend ## Your role You are outside counsel to Alderpoint Benefits, a benefits-administration firm, called in Saturday morning after a Friday-night ransomware attack. A company sale is scheduled to sign in three weeks. Advise on the next 72 hours and the next 45 days. ## Governing law 1. Notice of a breach of security must be given to affected individuals without unreasonable delay, and no later than 45 days after determination that a breach occurred, when unauthorized acquisition of personal information creates a reasonable likelihood of harm. Personal information includes name plus Social Security number, financial account, or medical information. 2. Notice to the state regulator is required within 72 hours of determining that a breach affects 500 or more residents. 3. Encryption of data at rest is a safe harbor only if the encryption key was not compromised. 4. "Acquisition" includes exfiltration shown by direct evidence or by a reasonable likelihood inferred from access, staging, or transfer indicators. Mere encryption of files by an attacker, without indicators of access or transfer, does not by itself constitute acquisition. 5. A forensic report is protected work product only if prepared primarily because of anticipated litigation. Reports prepared in the ordinary course of incident response, or serving dual business purposes such as remediation and customer assurance, are ordinarily discoverable even if counsel retained the examiner. 6. Paying a ransom is not itself unlawful unless payment is made to a sanctioned person or jurisdiction. A payer must screen the recipient and may face strict liability for payments to sanctioned parties. 7. A party anticipating litigation must preserve evidence, including affected systems and logs, subject to reasonable operational needs. 8. Contractual and common-law duties may require a service provider to notify business customers whose data it processes, separate from statutory individual notice. ## Facts Friday 11:40 p.m.: ransomware encrypted a majority of Alderpoint's file servers. A ransom note demands $1.9 million and claims exfiltration of "2 TB of your files," with a "proof pack" of 40 files posted to a leak-site link. The proof pack includes an HR spreadsheet containing names and Social Security numbers of Alderpoint's 3,100 employees, and several client contract PDFs. Alderpoint administers benefits for 240 employer clients, holding participant data for roughly 1.9 million individuals: names, Social Security numbers, dates of birth, and health-plan enrollment records. That participant database sits on a segmented server that was not encrypted by the attack. Firewall logs show 9 GB of outbound transfer to a foreign IP address between 10:05 and 11:20 p.m. Friday. The logs do not identify which files moved. The participant database's audit log shows a query session of unusual size at 10:12 p.m. from a compromised administrator account. Before counsel was engaged, Alderpoint's system administrator wiped and reimaged six infected servers "to get people working," destroying their local logs. Backups exist for four of the six. The CEO's draft customer email states: "We experienced a brief encryption event. There is no evidence any customer data was accessed." The CEO also wants the forensic firm, which Alderpoint has used for routine security assessments for years, to "run the investigation like always and copy the IT team." The acquisition agreement's diligence certificate, to be signed in three weeks, requires disclosure of "any security incident reasonably likely to result in material liability." The cyber insurer's policy requires notice "as soon as practicable" and written consent before any ransom payment, and designates panel counsel and panel forensics. The board asks: whether and when individuals, regulators, and clients must be notified; whether to negotiate or pay; whether the CEO's email can go out; and how to structure the investigation. ## Assignment Analyze: * Whether "acquisition" has occurred or is reasonably likely for the employee spreadsheet and, separately, for the participant database, and what that means for each notification clock. * When each clock starts, what "determination" means on these facts, and the sequencing of regulator, individual, client, and insurer notices over the next 72 hours and 45 days. * Who must send participant notices, Alderpoint or its employer clients, under the supplied service-provider rule and typical contractual allocation, and how to manage 240 clients without chaos. * The CEO's draft email: each statement's accuracy and the liability created by sending it. Redraft the two sentences so they are accurate and defensible. * Structuring the forensic engagement for protection under the supplied work-product rule, given the firm's routine prior role, and whether the insurer's panel requirements change the answer. * The ransom decision: lawful preconditions, screening, insurer consent, and what payment does and does not buy given the leak-site posting. * The server reimaging: preservation consequences and immediate remediation. * Disclosure to the acquirer under the diligence certificate, and timing relative to signing. * A 72-hour action list in priority order. --- ---