Cloud breach at Artys Inc.: A 96-hour disclosure and communication dilemma

Abstract

This case is about a cyberattack on a software publisher where the intruders created and consumed a lot of cloud computing capacity in a very short period of time. It was strongly suspected the purpose of the intrusion was crypto mining. There were no observed traces of any other malicious activity. A professional forensic investigation was inconclusive because of lack of evidence – it did not find any proof of data compromise, nor did it prove there was no data theft. In such situation, the CEO and the leadership team had a tough decision to make. They might be contractually bound to disclose this event to their customers, but there was serious misalignment on the interpretation of contracts. The potential penalties of a wrong judgement were high, and so were the consequences of voluntarily disclosing the incident to the customers. The CEO must decide what to do next – to disclose or not, and manage the risks in either case.