Case Study:

The Board of Directors at an international financial services organization, headquartered in London with offices in financial centers throughout the world, including Paris, New York and Hong Kong, were considering a confidential merger offer. On a Friday afternoon, before a three day weekend, the CIO received a ransom email from an unknown source stating they knew about the merger plans and had personal details of 150,000 customers. A sample of personal details for 500 customers was included in the ransom email as "proof". Unless a significant ransom was paid in Bitcoin they would leak the merger plans and sell the customer information. Herbert Smith Freehills was immediately engaged as legal counsel to manage and advise on the incident response and started work immediately, aided by forensic computer specialists, to assess and contain the threat.

Questions:

1- Give three possible scenarios on how the attacker was able to retrieve the information.

2- What should be, in your opinion, the course of actions that will need to be taken by the CIO.

3- What could other companies learn for this incident and what steps should they do to avoid such attack.