Deloitte is one of the biggest professional services companies in the world based on both revenue ($38.8 billion in 2017) and number of professionals (over 263,000). It provides audit, tax, management consulting, financial advisory services, and cybersecurity guidance to over 85 percent of the Fortune 500 companies and more than 6,000 private and middle market companies around the world. Its global headquarters is in New York. 

In April 2017, the company discovered that its global email server had been hacked starting six months earlier. The hackers gained access to the system through an administrative account that granted them privileged, unrestricted access to all areas. Apparently, the account required just a single password and did not have two-step verification. 

Deloitte offers its clients advice on how to manage the risks posed by sophisticated cyberattacks. It also operates a Cyber Intelligence Center to provide clients with around the-clock business focused operational security. In 2012, Deloitte was ranked the best cybersecurity consultant in the world. The firm earns a portion of its $12 billion a year in consulting fees from these services. The breach was a deep embarrassment for the firm. 

Critical Thinking Questions

1. Identify what you believe to be the area of most severe consequences for Deloitte—direct impact, business disruption, recovery, legal, or reputation. Justify your response. 

2. How would you evaluate Deloitte’s response to this cyberattack? What did they do well? Where could they have done better?

3. Identify the three highest priority changes that need to be made to the Deloitte security program.