Cyber incident tracker
Confirmed cyber incidents in Canada and the US, plus a few well-documented cases from further afield. What happened, what it cost, and questions you can lift straight into your own tabletop exercise.
-
Sep 2026 Burnaby School District · British Columbia, Canada A school district lost its phones and internet, then learned student files had been copied.
What happened
On September 21, 2026 an unauthorized third party got into the district's systems. Internet and phone lines at Burnaby public schools went down, along with school websites and portals (CTV News). The district said files containing personal information were copied before it contained the incident.
Impact
The district said the files included student names, contact details, birth dates and grades, kindergarten assessment notes, lists of students receiving extra support (sometimes with diagnoses) and staff personnel records. It called the impact limited, notified the RCMP and B.C.'s privacy commissioner, and offered families a fraud alert service (CTV News, The Canadian Press).
Sources: CTV News, CTV News (via CP24), The Canadian Press (via Narcity)
Use it in your tabletop
Technical team
Phones and internet are down in every school on a Monday morning. What comes back first, and how do you know the intruder is gone before it does?
Listen for
- Emergency phone lines treated as the first priority
- Accounts and access reviewed before systems return
- Logs kept for the investigation
Leadership
Investigators confirm files were copied, including notes on students who get extra support. What do families hear, in what order, and who answers their calls?
Listen for
- A plain notice: what was taken and what to do
- Staff told before the public
- One team ready for calls from parents
Board
Trustees learn that support plans and some diagnoses were in the copied files. What does the board need from staff, and what does it ask about how that data was kept?
Listen for
- The board overseeing the response, not running it
- A question on why that data sat where it did
- A date for a full report back
-
Aug 2026 Health Sciences Centre Winnipeg (Shared Health) · Manitoba, Canada An attack on a hospital's building systems hit its door access and ventilation.
What happened
Shared Health said on August 10, 2026 that an attack had affected certain facility maintenance systems at Manitoba's largest hospital, including heating, ventilation, cooling and door access. It said clinical services continued uninterrupted and there was no sign patients had been affected (The Canadian Press).
Impact
The Manitoba Nurses Union raised safety concerns about the doors and said it had heard guards were posted at entrances (The Canadian Press). Shared Health did not say when the breach began or whether the attackers made demands. The hospital was still recovering a week later (CTV News).
Sources: The Canadian Press (via Global News), CTV News, CTV News, a week later
Use it in your tabletop
Technical team
The system that runs door locks and air handling starts acting up. Who owns it, what else is it connected to, and who can take it offline?
Listen for
- A named owner for building systems, not just IT
- A way to run doors and ventilation by hand
- Building systems kept apart from the main network
Leadership
Some doors may not lock and others may not open. Clinical systems are fine. What changes on the floor in the next hour, and who tells staff?
Listen for
- People posted at the affected doors
- A message to staff on what is safe and what is not
- The union and safety committee kept informed
Board
The board realizes its cyber reporting has only ever covered IT, not the systems that run the building. What does it ask management to bring back?
Listen for
- A list of connected building systems
- One owner for their security
- A date to report back
-
Aug 2026 The Hospital for Sick Children (SickKids) · Ontario, Canada A flaw in shared third-party software exposed a children's hospital's staff and job applicant data.
What happened
SickKids said on August 20, 2026 that a vulnerability in a third-party software application, used by SickKids and other organizations, led to unauthorized access to personal information of some current and former employees and job applicants, including staff of the SickKids Foundation. The incident briefly took its careers website offline.
Impact
SickKids said no clinical systems or patient information were involved and patient care carried on as usual. It offered those affected two years of free credit monitoring (CTV News, The Record). It did not name the vendor or say how many people were affected.
Sources: CTV News (via CP24), The Record
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
A vendor you share with other organizations announces a flaw that attackers are already using. How fast can you tell whether your copy was hit, and what do you switch off while you check?
Listen for
- A list of which vendor apps hold staff data
- The app taken offline until it is patched
- The vendor's warning signs checked against your own logs
Leadership
Former employees and job applicants are in the data, some from years ago. How do you reach them, and what do you offer?
Listen for
- A notice that says what was taken and what to do
- Credit monitoring offered
- A question on why applicant data was kept that long
-
Dec 2025 Leduc County · Alberta, Canada A county found ransomware on Christmas Day and worked without full email for three weeks.
What happened
Leduc County found a ransomware attack during a routine systems check on December 25, 2025. The attack disabled some IT systems and the county shut others down on purpose during the forensic investigation. It notified the RCMP, its insurer and its banks (county updates, CTV News).
Impact
The county restored email in phases, putting public services, municipal deadlines and financial management first, and had every address back by January 16, 2026. It said work to date showed minimal information had been affected, though the investigation was not finished (county updates).
Sources: Leduc County updates, Leduc County notice, CTV News
Use it in your tabletop
Technical team
Christmas Day, a skeleton crew, and a routine check finds ransomware. Who can you reach today, and what do you shut down before anyone else is back?
Listen for
- A holiday call list that actually works
- Authority to shut systems down without waiting
- The outside forensic firm's number on hand
Leadership
Email will be down for weeks. Which services come back first, and how do residents and staff reach you in the meantime?
Listen for
- A priority list agreed before the incident
- A public update page with dates
- Payments and deadlines handled another way
Board
Council meets in the new year with systems still down. Which decisions are council's, and how will it hold staff to the recovery plan?
Listen for
- A position on paying a ransom, set before it is needed
- Updates against agreed restore dates
- One spokesperson for the county
-
Sep 2025 Jaguar Land Rover · United Kingdom A carmaker's production stopped for five weeks, and the government backed a loan for its suppliers.
What happened
Jaguar Land Rover announced a cyberattack on September 2, 2025 that forced it to shut down systems, stop production at major plants and send staff home. It later confirmed some data was stolen (BleepingComputer).
Impact
On September 29 the UK government approved a £1.5 billion loan guarantee to help the company pay suppliers, many of them small firms, and production restarted in phases by October 8. The company put the cost of the attack at £196 million for the quarter (BleepingComputer, City A.M.).
Sources: BleepingComputer, City A.M.
Use it in your tabletop
Technical team
Every plant depends on the systems that were hit. How do you restart one line safely while the investigation is still going?
Listen for
- A safe-restart order agreed with operations
- Systems checked before they reconnect
- Steps that can run by hand
Leadership
Your small suppliers say they'll run out of cash within days because you can't place or pay orders. What do you do for them, and how fast?
Listen for
- Critical suppliers identified
- A way to pay them without the usual systems
- Regular contact so they stay with you
Board
The board learns the company's cyber insurance won't cover this. What would a month without production cost, and who can carry it?
Listen for
- The cost of downtime worked out before it happens
- Insurance cover checked against that cost
- Options for cash, including lenders and government
-
May 2025 Kettering Health · Ohio, US Ransomware took a hospital system's records and phones offline for weeks.
What happened
Kettering Health's internal systems, phones and electronic health record went offline. Facilities cancelled elective procedures and some ambulances were diverted.
Impact
Outages lasted about two weeks (The Record). Kettering later said the attackers had access from April 9 to May 20, 2025 (BankInfoSecurity).
Sources: The Record, BankInfoSecurity
Use it in your tabletop
Technical team
Every site's records system and phones are down. Do you shut everything off, or one site at a time?
Listen for
- One named person allowed to disconnect
- Logs saved before anything is rebuilt
Leadership
7 a.m. and your main system is down. Which services get cancelled, and who tells the people affected?
Listen for
- A list of critical services agreed in advance
- One spokesperson
- A time for the next update
Board
The CEO calls the chair at 9 a.m. What does the board need to know today, and which decisions are the board's?
Listen for
- The board overseeing, not running the response
- An agreed line on ransom and disclosure
-
Apr 2025 Marks & Spencer · United Kingdom Attackers talked a third party into resetting a password, and a major retailer stopped selling online for weeks.
What happened
The chairman told UK Parliament the attackers got in on April 17, 2025 through an impersonation that tricked a third party into resetting a password. Ransomware followed, and the company shut down its systems to stop it spreading (BleepingComputer).
Impact
Online orders were paused from April 25, and click and collect only returned in August. The company expected a hit of about £300 million to operating profit, and confirmed customers' names, addresses, dates of birth and order history were taken, with card details only in masked form (Retail Systems, Tom's Guide).
Sources: BleepingComputer, Tom's Guide, Retail Systems
Use it in your tabletop
Technical team
A caller says they're an employee locked out of their account and asks the help desk, maybe an outsourced one, to reset the password and the second factor. What checks happen before anyone does it?
Listen for
- Identity checked through a separate channel
- Extra checks for admin accounts
- The same rules for an outsourced help desk
Leadership
You've shut systems down and online sales have stopped. How long can you go without them, and what do stores, staff and suppliers hear today?
Listen for
- The cost of each week offline, worked out
- Manual workarounds for stores
- One message for staff and suppliers
Board
The company expects a hit to profit in the hundreds of millions. What does the board need to see on insurance, on disclosure to investors, and on the outsourced help desk contract?
Listen for
- What insurance will and won't cover
- Market disclosure duties
- Who answers for the help desk failure
-
Apr 2025 Nova Scotia Power · Nova Scotia, Canada A utility's customer systems were breached while the power stayed on.
What happened
Nova Scotia Power and its parent Emera said they found unauthorized access to parts of their Canadian network. The customer phone line and online account portal were affected; generation and distribution were not. A month later the utility confirmed it was a ransomware attack.
Impact
About 280,000 people were notified, and the attackers had access from March 19 to April 25, 2025 (The Record). The utility said it had not paid the ransom (CBC).
Sources: Company release, CBC, The Record
Use it in your tabletop
Technical team
Forensics say the attackers were inside for five weeks before anyone noticed. What does that change about what you assume was taken?
Listen for
- Everything they could reach treated as possibly copied
- The way in closed before cleanup ends
- A timeline you can defend to regulators
Leadership
Your call centre and online accounts are down, and customers are flooding social media. Draft the first post. Who has to approve it?
Listen for
- A short post out within hours
- One approver, named in advance
- What customers should do, not just what happened
Board
It's confirmed as ransomware and customer data has been posted online. Management recommends not paying. What does the board need to hear to back that?
Listen for
- Why paying wouldn't get the data back
- The plan for notifying affected customers
- The regulatory and reputational exposure
-
Dec 2024 Toronto District School Board (vendor: PowerSchool) · Ontario, Canada A software vendor's breach exposed student records going back decades.
What happened
PowerSchool told the board its student information system had been breached in late December 2024. Data included student names, birth dates, health card numbers and home addresses.
Impact
Ontario's privacy commissioner said 19 Ontario boards were part of the breach (Global News). The board later learned the data had not been destroyed, despite earlier assurances.
Sources: TDSB notice, Ontario and Alberta commissioners, Global News
Use it in your tabletop
Technical team
Your software vendor says attackers got in through its customer support portal and took your records. What can you check on your side, and what do you ask the vendor for?
Listen for
- Your own access to the vendor system reviewed
- A list of exactly what data the vendor held
- The vendor's forensic findings in writing
Leadership
The vendor says it paid the attackers to delete your data. What proof would satisfy you, and do families hear about it now or later?
Listen for
- The vendor's assurance treated as unproven
- Families told what was held and what to do
- A plan if the data turns up anyway
Board
Regulators later find that vendor contracts left out required privacy and security terms. What does the board ask about every vendor that holds your data?
Listen for
- A list of vendors and what each holds
- Contracts checked against the rules
- One person accountable for vendor oversight
-
Jul 2024 CrowdStrike update (worldwide) · Texas, US Not an attack: a faulty security update crashed millions of Windows machines.
What happened
CISA said a global outage was caused by a CrowdStrike content update, not a cyberattack. Many organizations had to fix affected machines one by one.
Impact
Microsoft estimated 8.5 million Windows devices were affected. CISA warned that attackers were using the outage for phishing.
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Half your laptops won't start after a vendor's update, and each needs hands-on repair. Who has the access and the people to do that today?
Listen for
- Recovery keys reachable when laptops are down
- Critical machines fixed first
- Extra hands lined up
Leadership
Staff start getting emails offering a quick fix for the outage. How do you tell everyone, fast, which instructions are real?
Listen for
- One trusted channel for instructions
- A warning about fake fixes
- A way to reach staff whose laptops are down
-
Jun 2024 CDK Global (software for car dealers) · Illinois, US A software supplier's outage pushed car dealers across North America onto paper.
What happened
CDK Global shut down its systems after cyberattacks, and dealers lost the platform they use for sales, inventory and accounting. Many moved to manual processes, including handwritten orders.
Impact
Publicly listed dealer groups reported the disruption to investors, and dealerships kept selling using alternative processes (Lithia Motors 8-K, AP).
Sources: Lithia Motors 8-K, AP via ClickOnDetroit
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
The vendor offers to reconnect you, but you can't confirm their systems are clean. Reconnect or wait? What would you need to see?
Listen for
- Evidence from the vendor, not just reassurance
- Your connection to them limited at first
- A close watch on activity after reconnecting
Leadership
Your core platform is a vendor's cloud service, and it goes dark for at least a week. Which processes run on paper tomorrow morning?
Listen for
- Paper forms and steps ready
- The few processes that must not stop, named
- A way to enter the paper records later
-
Jun 2024 London hospitals (vendor: Synnovis) · United Kingdom Ransomware at a lab services provider stopped blood tests and operations at major London hospitals.
What happened
On June 3, 2024 ransomware hit Synnovis, which runs pathology services for King's College Hospital and Guy's and St Thomas' in London. Its chief executive said all its IT systems were affected, and blood tests were limited to the most urgent cases (Cyber Daily, BleepingComputer).
Impact
By the end of June, NHS England said 4,913 outpatient appointments and 1,391 planned procedures had been postponed at the two hospital trusts. The attackers published data said to include patient names, NHS numbers and test descriptions (PA Media, via Express and Star; Infosecurity Magazine).
Sources: BleepingComputer, Cyber Daily, Express and Star, Infosecurity Magazine
Use it in your tabletop
Technical team
Your lab provider's systems are all down. Which of your own systems connect to theirs, and do you cut those links while they recover?
Listen for
- A map of connections to the provider
- Links cut until the provider is confirmed clean
- A safe way to receive urgent results
Leadership
Blood tests can only be done for the most urgent patients. Who decides which procedures go ahead, and how do patients hear about cancellations?
Listen for
- Clinical leaders deciding priority, not IT
- Patients told directly, not through the news
- Other providers lined up for urgent work
Board
One outside provider can halt surgery across your hospitals. What does the board need to see about that dependency and the backup plan?
Listen for
- Critical suppliers named and ranked
- A tested plan for running without them
- Contract terms on recovery time
-
Jun 2024 Patelco Credit Union · California, US A credit union shut down online banking for more than two weeks.
What happened
Patelco said it shut down some banking systems to contain a ransomware attack. Online banking, the mobile app and the call centre were down, and card payments worked in limited capacity.
Impact
Online banking returned on July 15 (Pleasanton Weekly). Patelco's notices to state attorneys general covered 726,000 people (GovInfoSecurity).
Sources: BleepingComputer, GovInfoSecurity, Pleasanton Weekly
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
You shut down core banking systems to contain ransomware. What has to be true before online banking comes back?
Listen for
- The way in found and closed
- Systems checked before they reconnect
- A staged return, most critical first
Leadership
Members can't see balances or move money, payroll deposits land tomorrow, and the call centre is down too. How do members hear from you?
Listen for
- Branches and the website used for updates
- Plain facts on what works and what doesn't
- Updates at set times
-
May 2024 American Radio Relay League (ARRL) · Connecticut, US A member association paid a $1 million ransom, largely covered by insurance.
What happened
ARRL said ransomware hit its headquarters systems and most of its cloud systems. Member services were offline for months.
Impact
ARRL told members it paid a $1 million ransom after days of negotiation, and that the payment and restoration costs were largely covered by insurance (ARRL, 2024).
Sources: ARRL report to members, BleepingComputer
Use it in your tabletop
Technical team
The negotiator says you'll get a decryption key if you pay. What do you check before relying on it, and what do you rebuild anyway?
Listen for
- Keys tested on copies first
- Systems rebuilt where trust is gone
- The way in closed either way
Leadership
Two months on, members ask why services are still down. What do you tell them, and how often?
Listen for
- A plain account of what's back and what isn't
- Updates at set times
- Honest dates, not hopeful ones
Board
The insurer's negotiator says the attackers will take a lower payment for a key. Who can approve a ransom payment here, and what do they need to know first?
Listen for
- Authority to approve set in advance
- Legal and sanctions checks
- What the insurer will and won't cover
-
Apr 2024 London Drugs · British Columbia, Canada A retailer closed every store in four provinces for more than a week.
What happened
London Drugs closed its stores in British Columbia, Alberta, Saskatchewan and Manitoba while it investigated, keeping pharmacists on site for urgent needs. Files taken from its head office were later released online.
Impact
Nearly 80 stores were closed for more than a week. The company said it was unwilling and unable to pay the ransom (Global News).
Sources: CBC, Global News
Use it in your tabletop
Technical team
Hour 4. Store systems are acting up and you can't yet tell how far it has spread. What do you disconnect first, and what has to keep working for the pharmacy?
Listen for
- A known list of what the stores depend on
- Pharmacy systems protected, not just switched off
- Evidence kept before anything is wiped
Leadership
Store systems are unreliable. Close every location, keep some open on paper, or stay open? Staff need to hear the decision before customers do.
Listen for
- One person who makes the call
- Essential services like the pharmacy covered
- Staff briefed first, with words they can use
Board
Day 10. After you refuse to pay, the attackers publish head office files, including employee records. What does the board need to know today, and does the position on paying still stand?
Listen for
- The stance on paying revisited on purpose
- Notifications to regulators tracked
- Support for affected employees paid for
-
Apr 2024 Ticketmaster and other customers (vendor: Snowflake) · Nationwide, US Attackers didn't break into the cloud provider. They signed in to customers' accounts with old stolen passwords.
What happened
From April 2024 a criminal group used usernames and passwords stolen by malware, some of them years old, to sign in to companies' accounts on Snowflake, a cloud data platform, and copy data. The accounts that were hit did not have multi-factor authentication turned on (Mandiant, SecurityWeek).
Impact
Mandiant and Snowflake notified about 165 organizations, and the group tried to extort victims and sell their data. Ticketmaster and Advance Auto Parts said they were investigating, and Snowflake said it would turn on multi-factor authentication by default (Axios, Mandiant).
Sources: Axios, Mandiant, SecurityWeek
Use it in your tabletop
Technical team
A cloud data service you use lets people sign in with a password alone. How many accounts, including contractors', can do that today, and how fast can you require a second factor?
Listen for
- A list of accounts on each cloud service
- Contractor and service accounts included
- Passwords changed after any known leak
Leadership
Criminals email you a sample of your customer data and ask for money, and you can't yet tell which account it came from. What do you do in the first day?
Listen for
- Incident response and legal brought in
- The vendor asked for its access logs
- No reply to the criminals until advised
Board
Your provider says the breach came from your company's own account security, not theirs. Who owns the security of your cloud services, and does the board know?
Listen for
- A named owner for each cloud service
- Basic settings checked regularly
- Cloud risk on the board's agenda
-
Feb 2024 Change Healthcare (UnitedHealth Group) · Tennessee, US One remote access portal without multi-factor authentication led to a $22 million ransom.
What happened
On February 12, 2024 attackers used stolen login details to get into a Change Healthcare remote access portal that did not have multi-factor authentication, and deployed ransomware nine days later, UnitedHealth's CEO told Congress (Cybersecurity Dive, Duo).
Impact
The CEO confirmed paying a $22 million ransom in bitcoin and called it one of the hardest decisions he had made. He estimated data on about a third of Americans could be affected, and said company policy required multi-factor authentication on systems facing the internet (Cybersecurity Dive).
Sources: Cybersecurity Dive, Duo
Use it in your tabletop
Technical team
Your remote access portal can be reached from the internet. Can you prove today that every way in asks for a second factor, including the ones nobody remembers setting up?
Listen for
- A full list of internet-facing ways in
- Second-factor checks tested, not assumed
- An owner for anything outside policy
Leadership
Your claims or billing system is down for weeks, and the customers who depend on it can't get paid. What do you offer them while you rebuild?
Listen for
- The customers hit hardest identified first
- A stopgap, such as advance payments or manual processing
- Updates at set times
Board
The CEO wants to pay a large ransom to protect patient data. Who makes that call, and what does the board need to see before it's made?
Listen for
- Who has authority to decide
- What paying can and can't guarantee
- Sanctions and law enforcement advice
-
Feb 2024 City of Hamilton · Ontario, Canada Phones, permits and fire paging on workarounds for months after ransomware.
What happened
The city confirmed a ransomware attack that encrypted its systems. Phones, permits, licensing and some fire and public health systems ran on manual workarounds or outside tools during a long recovery.
Impact
The city reported $18.4 million spent on recovery by July 2025 and did not pay the ransom. Its insurer declined about $5 million in claims, and a staff report said the policy excludes losses where missing multi-factor authentication was the root cause. The city's acting chief information officer said the breach would have happened even with it in place (CBC).
Sources: City of Hamilton FAQ, CBC, CBC
Our write-up: Why was the City of Hamilton's cyber insurance claim denied?
Use it in your tabletop
Technical team
Day 3. The insurer's adjuster wants proof that multi-factor authentication was on for every remote access path on the day of the attack. Who pulls that evidence, and what if one path didn't have it?
Listen for
- A named owner for the evidence
- Settings and logs saved before systems are rebuilt
- A straight answer on any gap, not a guess
Leadership
Week 2. Phones are still down. Which services must still reach the public, and how do you take calls and payments without your main systems?
Listen for
- Services ranked before the day, not on it
- A manual way to take payments that finance has approved
- One public channel for updates, at set times
Board
The attackers want a ransom, and the insurer is questioning the claim. Which of these calls belong to your board or council, and what do you need from staff to make them?
Listen for
- A position on paying that the board owns
- Questions to management, not instructions to IT
- A view on what an unpaid claim does to the budget
-
Dec 2023 Memorial University, Grenfell Campus · Newfoundland and Labrador, Canada Ransomware locked one campus's servers and pushed back the start of term.
What happened
Memorial became aware of IT issues at its Corner Brook campus on December 29, 2023 and later confirmed ransomware had encrypted data on servers and workstations there. It isolated the campus network and briefly shut down IT at another campus as a precaution (Memorial University, BleepingComputer).
Impact
Classes at Grenfell were pushed back from January 4 to January 8, and resident students were left without internet or Wi-Fi for a time (BleepingComputer, citing the university). The university's president said no data was compromised (CBC).
Sources: Memorial University, CBC, BleepingComputer
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
One campus's servers are encrypted, and the others share accounts and services with it. Do you cut the links between sites, and what has to be true before you reconnect?
Listen for
- Shared accounts and links between sites known in advance
- Passwords reset before anything reconnects
- Data scanned before it is restored
Leadership
Term starts in five days and one campus has no network. Delay, carry on without it, or move teaching elsewhere? Who decides, and by when?
Listen for
- A named decision-maker and a deadline
- Students' basics covered first: housing, internet, payments
- One update schedule for staff and students
-
Oct 2023 British Library · United Kingdom A national library's old systems turned a ransomware attack into a full rebuild.
What happened
In October 2023 attackers got into the British Library's network, most likely with a third party's stolen login on a remote access server that did not use multi-factor authentication. The growing use of third parties on the network had been flagged as a risk in late 2022 (British Library review, Infosecurity Magazine).
Impact
The library refused to pay, and the attackers put the stolen data up for sale. Its review said its legacy systems contributed to how severe the damage was, and recovery was expected to cost about £7 million, around 40 per cent of its reserves (British Library review, Infosecurity Magazine, Dark Reading).
Sources: British Library, Infosecurity Magazine, Dark Reading
Use it in your tabletop
Technical team
Outside partners reach your network through a remote access server that takes a password only. The risk was flagged last year. What do you do this week?
Listen for
- A list of every partner with access
- A second factor on every outside way in
- Access that ends when the work ends
Leadership
Your public-facing systems will be down for months, not days. What do you keep running by hand, and how do you tell the people who rely on you?
Listen for
- The few services that matter most, named
- An honest timeline, updated regularly
- Staff told before the public
Board
The rebuild will take a large share of your reserves, and old systems made the damage worse. What does the board fund now, and what does it stop putting off?
Listen for
- A plan to retire systems that can't be secured or restored
- Funding tied to the biggest risks
- Progress reported back on a schedule
-
Oct 2023 Five southwestern Ontario hospitals (TransForm) · Ontario, Canada Five hospitals, one shared IT provider, one attack.
What happened
Ontario's privacy commissioner said attackers used compromised administrator accounts at TransForm, the hospitals' shared IT provider, to steal data and encrypt 192 servers. Hospitals moved to paper charting and asked people to avoid emergency departments unless it was urgent.
Impact
The commissioner said 267,000 patient records were taken at Bluewater Health alone, and found the hospitals should also have told patients their records were encrypted (IPC PHIPA Decision 284, 2025).
Sources: IPC Ontario decision, CBC
Use it in your tabletop
Technical team
Your managed IT provider calls. Their network is down, they suspect ransomware, and your systems run on theirs. What can you still run on your own, and what do you cut off from them?
Listen for
- A list of what depends on the provider
- Links to the provider cut until it is clean
- One technical contact at the provider
Leadership
Day 5. Client records were encrypted, but there's no sign they were stolen. Does that still need reporting where you operate? Settle it before the deadline, not after.
Listen for
- Legal advice on the reporting rule, sought early
- The decision written down with its reasons
- Who tells clients, and when
Board
Every organization that shares your IT provider is down at once. How does the board oversee the provider's recovery, and what changes in the contract afterwards?
Listen for
- Oversight of the provider, not blind trust
- Contract terms on notice, security and recovery
- A plan for the next time the provider fails
-
Oct 2023 Toronto Public Library · Ontario, Canada A library system's website and branch computers went dark for months.
What happened
An October 2023 cyberattack took down the library's website and its network of public computers across 100 branches. Holds, printing and card renewals stayed unavailable into 2024, and the library called its plan to restore services from January an aggressive timeframe (The Canadian Press).
Impact
The library said it did not pay a ransom. It said the attack likely exposed names, social insurance numbers, government ID and addresses of employees going back to 1998, and that some customer, volunteer and donor data may also have been exposed (CBC, The Canadian Press).
Sources: CBC, The Canadian Press
Use it in your tabletop
Technical team
Thousands of staff and public computers may be infected. How do you decide which come back first, and what has to be true before each one does?
Listen for
- A clean-or-rebuild rule set before the first machine
- Staff machines before public ones
- A record of every machine cleared
Leadership
Staff records going back 25 years were on a compromised server. What do you tell current and former employees, and how do you reach people who left years ago?
Listen for
- A notice that says what was taken and what to do
- Credit monitoring offered
- A plan for people with no current address on file
Board
Recovery will take months and the attackers want payment. Which calls are the board's, and how will it hold management to the recovery plan?
Listen for
- A stated position on paying
- Updates against agreed restore dates
- A question on why staff data was kept that long
-
Aug 2023 The Clorox Company · California, US A cyberattack forced a consumer goods maker into manual order processing.
What happened
Clorox took systems offline after finding unauthorized activity, activated its business continuity plans and moved to manual ordering at a reduced rate.
Impact
Clorox said the impact on its quarterly results would be material, and reported $49 million in costs by the end of 2023 (SEC filings, CFO Dive).
Sources: Clorox 8-K (Aug 2023), Clorox 8-K (Sep 2023), CFO Dive
Use it in your tabletop
Technical team
You've taken order systems offline to contain an attack. What do you check before automated ordering comes back?
Listen for
- Order data reconciled with the manual records
- Systems confirmed clean
- A staged return, starting small
Leadership
You switch to manual order processing. What's your daily capacity on paper, and which customers get served first?
Listen for
- Capacity known, not guessed
- Priority customers agreed in advance
- Sales told what they can promise
Board
The company expects a material hit to the quarter. What does the board need to see before results are announced?
Listen for
- Costs tracked from day one
- Disclosure duties understood
- Insurance recoveries reflected in the numbers
-
May 2023 City of Dallas · Texas, US A city said no personal data was taken, then admitted it had known otherwise for weeks.
What happened
Attackers were in the city's network from April 7, 2023, copying data until May 4, and the city spotted the ransomware on May 3 (GovTech). The city's own report says they got in with a stolen service account, and restoring servers ran from May 9 to June 13 (Security Affairs).
Impact
For weeks officials said no sensitive information was accessed, but the city later confirmed it had known by June 14 that personal data was, and the count reached 30,253 people. Council set aside about $8.6 million for vendors, and the city offered two years of credit monitoring (KERA News, CBS News).
Sources: KERA News, CBS News, GovTech, Security Affairs
Use it in your tabletop
Technical team
Your monitoring flags ransomware on several servers. Later you learn the attackers were inside for almost a month first. What do you check to find what they took?
Listen for
- Logs kept long enough to look back weeks
- Accounts used by systems, not people, checked
- Outbound data transfers reviewed
Leadership
Early on, your spokesperson says no personal data was accessed. Six weeks later you learn it was. What do you say, and how fast?
Listen for
- Early statements limited to what's confirmed
- A correction made quickly and plainly
- Notice deadlines tracked from the day you knew
Board
Council is asked to approve millions for vendors after the attack. What does it want to see first, and what does it want changed for next time?
Listen for
- A clear account of what the money buys
- Lessons written up and shared
- An owner and a date for each fix
-
Apr 2023 HWL Ebsworth · Australia Hackers published a million documents from a law firm, exposing 65 government clients.
What happened
In April 2023 attackers broke into HWL Ebsworth, one of Australia's largest law firms, and took about 2.5 million documents. The firm first learned of it on April 26 through emails that had been sorted as spam (Law Society Journal, GovInfoSecurity).
Impact
The firm refused to pay a ransom of about A$7.1 million, about a million documents were published in June, and it won a court injunction against further publication. The national cyber security coordinator said 65 Australian government bodies were affected as clients of the firm, along with many private sector clients (Law Society Journal).
Sources: Law Society Journal, GovInfoSecurity
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Extortion emails about a breach have been landing in your spam folder. Who checks for messages like that, and how would they reach the incident lead?
Listen for
- Someone who reviews threats sent to general inboxes
- A fast route to the incident lead
- Evidence kept as it arrives
Leadership
Documents from government and corporate clients are now public. Which clients do you call first, and who makes each call?
Listen for
- Clients ranked by what was exposed
- A senior partner for each key client
- The same facts in every call
-
Apr 2023 Hydro-Québec · Quebec, Canada A denial-of-service attack knocked a utility's website and app offline.
What happened
Hydro-Québec said its website and mobile app were targeted overnight and knocked out. The outage map stayed available.
Impact
The utility said power delivery and customer data were not affected. A group claimed responsibility, which the utility could not confirm (CTV).
Sources: BNN Bloomberg, CTV
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
2 a.m. Your website and customer app are buried under junk traffic, and a group claims credit online. What do you do first, and who do you call?
Listen for
- Your hosting or protection provider called
- Core operations confirmed unaffected
- A record of the traffic kept
Leadership
Reporters ask whether customer data was taken. You don't know yet. Write the one sentence your spokesperson can say.
Listen for
- Nothing said that you can't stand behind
- A time for the next update
- No comment on who did it until it's confirmed
-
Mar 2023 Orrick, Herrington & Sutcliffe · California, US A law firm's breach exposed data it held for its clients' customers.
What happened
An attacker had access to the firm's network for about four months before it was detected. The firm held personal and health information for its clients' customers, so notices went to more than 638,000 people.
Impact
Class actions were consolidated and a court approved an $8 million settlement in 2024. The firm denied liability (ABA Journal).
Sources: ABA Journal, BankInfoSecurity
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
You find an intruder who has been in your network for months, and some of the data belongs to your clients' customers. How do you work out whose data was on the systems they reached?
Listen for
- A map of client data by system
- Evidence kept for forensics and the courts
- Forensics run through legal counsel
Leadership
Forensics keeps finding more affected people. Notify now with a number that will change, or wait for a final count? And who calls each client?
Listen for
- Notice deadlines tracked by jurisdiction
- A first notice that says the count may grow
- A partner assigned to each affected client
-
Feb 2023 Indigo Books & Music · Ontario, Canada A bookstore chain went cash-only in its stores and couldn't sell most of its books online for weeks.
What happened
A cyberattack on February 8, 2023 took Indigo's website and app offline, and for several days stores could take only cash. About three weeks later the company confirmed it was ransomware and that data on current and former employees had been taken (The Canadian Press, via Global News).
Impact
Indigo said it found no sign that customer data such as card numbers was accessed. It refused to pay, saying it could not be sure the money would not reach terrorists or sanctioned groups and that paying would not guarantee the data was deleted (The Canadian Press, BNN Bloomberg).
Sources: Global News, BNN Bloomberg
Use it in your tabletop
Technical team
Your tills and online store run on systems connected to the network that was hit. Can stores take cards safely while you investigate, and who decides?
Listen for
- A known map of what the tills depend on
- The payment provider brought in early
- A clear rule for going cash-only, and for ending it
Leadership
Three weeks in, you learn employee data was stolen and may be posted online tomorrow. What do current and former staff hear from you tonight?
Listen for
- Staff told before they read it in the news
- What was taken and what to do about it
- Credit monitoring and a contact person
Board
The attackers set a deadline and management recommends not paying. What does the board need to see to back that, and how will it be explained?
Listen for
- Legal and sanctions advice on any payment
- The decision and its reasons on the record
- A public line agreed in advance
-
Dec 2022 Rackspace Technology · Texas, US A hosting company held off on an email patch, then lost its whole hosted email service to ransomware.
What happened
On December 2, 2022 ransomware took down Rackspace's hosted Microsoft Exchange email service, used by about 30,000 customers, most of them small and mid-sized businesses. Rackspace had held off on Microsoft's November patches over reports they caused sign-in errors, and relied on interim workarounds that the attackers got around (Dark Reading, Cybersecurity Dive).
Impact
Rackspace said the attackers reached stored mailbox files for 27 customers, and that it would not rebuild the service, moving customers to Microsoft 365 instead. Some customers were trying to recover a decade of old email, and the outage led to class action lawsuits (The Register, Cybersecurity Dive).
Sources: Dark Reading, Cybersecurity Dive, The Register
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
A critical patch is out, but early reports say it breaks sign-ins. Do you patch, use the interim workaround, or switch the service off until you can patch? Who decides?
Listen for
- The risk of waiting written down
- A deadline for the workaround to end
- Someone with authority to switch the service off
Leadership
Your hosted email service is gone for good, and customers want years of old messages back. What do you tell them, and what do you offer?
Listen for
- Honest timelines for old data
- A way to keep working in the meantime
- One place customers can get updates
-
Sep 2022 Los Angeles Unified School District · California, US The second-largest school district in the US refused to pay, and the attackers published 500 gigabytes of its data.
What happened
According to the district's later notices, attackers were inside its network from July 31 to September 3, 2022, and the attack caused what the district called significant disruption (SC Media, Axios). The superintendent called the ransom demand absurd and said the district would not negotiate (Spectrum News).
Impact
The district said paying never guarantees full recovery and that public money was better spent on students. The attackers then published about 500 gigabytes of district data, which the superintendent confirmed (Axios, Spectrum News).
Sources: Axios, Spectrum News, SC Media
Use it in your tabletop
Technical team
Attackers were inside for five weeks before setting off ransomware over a long weekend. Who is watching on holidays, and what would wake someone up?
Listen for
- Coverage on weekends and holidays
- Alerts that reach a person, not just an inbox
- A call list in a set order
Leadership
The attackers set a deadline to publish student and staff data. Families are calling the schools. What do you tell them before you know what was taken?
Listen for
- Facts only, no guesses about the data
- What families should watch for
- One number or page for questions
Board
The board must decide whether to pay to stop student data being published. What does it weigh, and how does it explain the decision to families?
Listen for
- What paying can and can't guarantee
- Advice from law enforcement
- A public statement the board can stand behind
-
Sep 2022 Suffolk County · New York, US A county missed an FBI warning and other red flags, then spent $25 million recovering from ransomware.
What happened
Ransomware hit Suffolk County's systems on September 8, 2022, and the attackers first demanded $2.5 million (Suffolk County Legislature report). Essential government services were disrupted for months (Cybersecurity Dive).
Impact
A legislative committee found the county had no incident response plan and no chief information security officer, had opened a gap in its main firewall for traffic to the county clerk's office, and did not act on an FBI call in June 2022 about suspicious traffic. Costs passed $25 million (Suffolk County Legislature report, Cybersecurity Dive).
Sources: Suffolk County Legislature, Cybersecurity Dive
Use it in your tabletop
Technical team
The FBI calls about suspicious traffic that may come from one of your departments. Who takes that call, and what happens in the next 24 hours?
Listen for
- A named person who owns outside warnings
- The lead investigated, not just noted
- Leadership told the same day
Leadership
Several departments run their own IT, and nobody owns security overall. In an attack, who is in charge?
Listen for
- One incident lead named in advance
- Every department's systems on one list
- A written incident response plan
Board
The legislature learns that risks it should have heard about were never reported. What does it require from now on, and from whom?
Listen for
- Regular security reports to the board or council
- Someone accountable for cyber risk
- Warnings escalated, not filed away
-
Aug 2022 Medibank · Australia One contractor's saved password led to the theft of 9.7 million health insurance customers' records.
What happened
In August 2022 a Medibank IT contractor's saved login details were synced to his personal computer and stolen by malware. The attacker used them to log into Medibank's VPN, which did not require multi-factor authentication, and later took about 520 gigabytes of data (Australian Information Commissioner's court filing, via BleepingComputer and Help Net Security).
Impact
The commissioner says security alerts in late August were not properly triaged or escalated. The attacker demanded payment and, when that failed, published data on 9.7 million current and former customers, and the commissioner took Medibank to court (Help Net Security, Cyber Daily).
Sources: BleepingComputer, Help Net Security, Cyber Daily
Use it in your tabletop
Technical team
Your IT contractors can sign in with admin rights from any device. What stops a password saved in a personal browser from becoming a way into your whole network?
Listen for
- A second factor on remote access, with no exceptions
- Admin rights limited to what each person needs
- Company-managed devices for admin work
Leadership
Attackers threaten to publish customers' health claims unless you pay. Customers are frightened. What support do you offer, and what do you tell them?
Listen for
- Plain advice on what to watch for
- Practical help such as identity protection
- Extra care for people whose health details are exposed
Board
An outside review finds known security gaps went unfixed for more than a year. What did the board see in that time, and what should it have asked?
Listen for
- Known gaps reported with dates and owners
- Board follow-up on overdue fixes
- Independent checks of what management reports
-
Jul 2022 Toronto Symphony Orchestra and other arts groups (vendor: WordFly) · Ontario, Canada Ransomware at an email vendor exposed patron lists for arts groups in Canada and abroad.
What happened
WordFly, which sends marketing email for arts organizations, was hit by ransomware on July 10, 2022, and the attacker exported customer data, including patron information it handled for the Toronto Symphony Orchestra (the orchestra's notice, via CTV News). WordFly was offline for more than two weeks (SecurityWeek).
Impact
The orchestra said patron names and email addresses were among the data, but no payment or financial information, apologized, and moved to another email provider in the meantime. WordFly said it understood the data was deleted from the attacker's possession on July 15 (CTV News, CP24).
Sources: CTV News, CP24, SecurityWeek
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Your email marketing provider is down after ransomware and says your patron list was copied. What exactly did you give them, and what can you switch to today?
Listen for
- A record of what each vendor holds
- A backup way to email patrons
- Old data you no longer need removed from vendors
Leadership
Patron names and emails were taken from a vendor. What do you tell patrons, and how do you warn them about fake emails that look like yours?
Listen for
- A short, honest notice
- A warning about phishing in your name
- An apology from someone senior
-
Jul 2022 Town of St. Marys · Ontario, Canada A small town paid a $290,000 ransom, and the attack cost it $1.3 million in all.
What happened
IT staff found ransomware during a routine backup on July 20, 2022 and disconnected every server at once, which the town said stopped it spreading further. Staff kept about 80 per cent of their functions (town report, via CTV News and Global News).
Impact
The town reported paying US$200,000 in bitcoin, about C$290,000, for decryption keys and for the stolen data to be destroyed. Its report put the total cost at $1.3 million (CTV News, Global News).
Sources: CTV News, Global News
Use it in your tabletop
Technical team
Your IT lead sees files being encrypted in the middle of a routine backup. Do they pull every server off the network right now, without asking anyone first?
Listen for
- Yes, and they know in advance that they're allowed to
- Backups checked before anyone relies on them
- A note of what was disconnected, and when
Leadership
Two days later the attackers say they have sensitive data and want payment. Who is in the room to decide what happens next, and who do you call first?
Listen for
- Legal counsel and the insurer called early
- Police told
- One person running the decision, with a deadline
Board
Staff recommend paying for the keys and for the data to be deleted. What does council need to hear before it decides, and how will it explain the choice to residents?
Listen for
- What paying does and doesn't guarantee
- Whether insurance covers the payment
- A plan to tell the public, whichever way it goes
-
Dec 2021 Lincoln College · Illinois, US A small college said a cyberattack contributed to its closure.
What happened
Lincoln College said a December 2021 attack blocked access to its data and hindered admissions for about three months. In May 2022 it announced it would close.
Impact
The college's statement cited both the attack and the financial impact of COVID-19 (CNN, AP).
Sources: CNN via KVIA, AP via Fox 32
Use it in your tabletop
Technical team
Recruitment, fundraising and student systems are all locked. Which comes back first, and how long would a full rebuild really take?
Listen for
- A restore order tied to the academic calendar
- An honest estimate, not a hopeful one
- Backups checked before they're trusted
Leadership
Your recruitment and fundraising systems go down in your busiest season. What does three months without them cost, and who tells the board?
Listen for
- The cost worked out week by week
- A manual way to keep recruiting
- The board told early, with numbers
Board
After the attack, enrolment projections fall well short, on top of earlier money trouble. What does the board need to decide, and how soon?
Listen for
- A clear view of the financial gap
- Options weighed, including outside help
- A timeline for the decision
-
Oct 2021 Newfoundland and Labrador health system · Newfoundland and Labrador, Canada Ransomware paralyzed a province's health system after early alerts went unchecked.
What happened
Attackers got into the province's Centre for Health Information through a virtual private network on October 15, 2021, using a legitimate user's stolen login, and deployed ransomware on October 30. Thousands of appointments, from imaging to cancer care, were cancelled, and staff went back to pen and paper (provincial government, via The Canadian Press).
Impact
The privacy commissioner's office found the attack was foreseeable, that alerts it set off beforehand were not properly investigated, and that the government broke privacy law by not disclosing key details fast enough. It said data was likely taken on the vast majority of the province's population (The Canadian Press, CBC).
Sources: CBC, The Canadian Press (2023 report), The Canadian Press (VPN entry)
Use it in your tabletop
Technical team
Two weeks ago your monitoring flagged odd activity on a remote access account, and nobody followed it up. Now ransomware is running. Who owns the alerts nobody reads?
Listen for
- The old alerts pulled and reviewed now
- One owner for alerts, with cover out of hours
- Remote access accounts checked for multi-factor authentication
Leadership
Imaging and cancer appointments are being cancelled. Who decides which care continues on paper, and how do patients find out whether their appointment is on?
Listen for
- Clinical leaders setting priorities, not IT
- Paper forms and routines ready to use
- A public line for patients, updated daily
Board
Weeks in, you still haven't said publicly that it was ransomware or whether data was taken. Who decides what the public is told, and when?
Listen for
- Privacy notice duties understood and tracked
- Police advice weighed against the duty to tell people
- A decision with a date, not left open
-
Aug 2021 Town of Peterborough · New Hampshire, US A small town lost $2.3 million to forged emails about routine transfers.
What happened
Thieves posing as school district staff used forged emails to redirect the town's monthly transfer to the district, plus two payments to a bridge contractor.
Impact
The town said it lost $2.3 million. The Secret Service later recovered about $594,000 (Concord Monitor).
Sources: NBC Boston, Concord Monitor
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Your biggest regular payee says this month's payment never arrived. It went to a new account set up by email. What do you check in the next hour?
Listen for
- The bank called to try to stop or recall the money
- Mailboxes checked for signs of takeover
- Who changed the account details, and how
Leadership
Do the finance staff who processed the payment step back while you investigate? Whatever you decide, the rest of the team is watching.
Listen for
- A fair process, not blame first
- Payments on hold until new checks are in place
- A clear message to the team
-
Jul 2021 IT service providers and their clients (vendor: Kaseya) · Florida, US Attackers used a tool that IT providers trust to push ransomware to their clients.
What happened
On July 2, 2021 attackers exploited a flaw in Kaseya's VSA, software that IT service providers use to manage their clients' computers, and pushed ransomware out through it. Kaseya shut down its own servers and told customers running VSA themselves to switch it off (Redmond, citing Kaseya).
Impact
Kaseya said about 60 of its customers were directly hit, most of them IT service providers, and between 800 and 1,500 businesses downstream. In Sweden most of the Coop chain's 800 supermarkets closed for the weekend because their tills stopped working (The Associated Press, via The Boston Globe).
Sources: The Boston Globe, Redmond
Use it in your tabletop
Technical team
Your IT provider runs a remote management tool on every machine you own. If that tool pushed out something malicious tonight, how would you know, and how fast could you cut it off?
Listen for
- Which tools your provider has installed
- A way to block the provider's access quickly
- Alerts that don't depend on the provider
Leadership
Your IT provider calls: their own tools were used to spread ransomware to clients, including you. Their staff are swamped. Who else can you call today?
Listen for
- A second incident response firm on file
- Your insurer's breach line
- Someone inside who knows your systems
Board
The board asks how much of the business depends on one IT provider. What does it want to see before renewing that contract?
Listen for
- The provider's own security and access controls
- Notice and support terms in the contract
- A plan for running without them
-
May 2021 Colonial Pipeline · Georgia, US An unused VPN account with no second factor led to a fuel pipeline shutting down.
What happened
Staff found a ransom note on the company's IT network at 5 a.m. on May 7, 2021 and shut down the pipeline to keep the malware away from operational systems. The CEO later told the Senate the attackers used the password for an old VPN profile that was not meant to be in use and had no multi-factor authentication (Dark Reading, Cybersecurity Dive).
Impact
The company paid a ransom then worth about $4.4 million in bitcoin the next day, and the CEO said the decision to pay and to keep it confidential was his. The Justice Department later recovered about $2.3 million (The Philadelphia Inquirer, Dark Reading).
Sources: Dark Reading, Cybersecurity Dive, The Philadelphia Inquirer
Use it in your tabletop
Technical team
You find old remote access accounts nobody uses, still active and signing in with a password only. What do you do this week, and how do you know there aren't more?
Listen for
- Unused accounts switched off now
- A regular review of every way in
- Multi-factor authentication on whatever remains
Leadership
A ransom note appears on office systems. Operations look fine, but nobody can say for sure. Do you shut operations down as a precaution, and who decides?
Listen for
- A named person allowed to stop operations
- Whether office and operational systems are really separate
- Customers told within the hour
Board
Management paid quickly and wants to keep the payment quiet. What is the board's view on paying, and on saying so publicly?
Listen for
- A stance on paying set before the day
- Law enforcement told
- A disclosure decision the board can defend later
-
May 2021 Health Service Executive · Ireland Ireland's health service missed several warnings in the eight weeks before ransomware hit.
What happened
On March 18, 2021 a staff member opened a malicious Excel file attached to a phishing email. The attackers worked inside the network for eight weeks before setting off ransomware on May 14, and security tools flagged their activity more than once without anyone starting an incident investigation (independent PwC review, via The Register and Krebs on Security).
Impact
It took until September 21 to decrypt every server. The review found no one at senior management level was responsible for cybersecurity, and the HSE's head said recovery costs would likely exceed US$600 million (Krebs on Security, Infosecurity Magazine).
Sources: The Register, Krebs on Security, Infosecurity Magazine
Use it in your tabletop
Technical team
Your antivirus flags hacking tools on one workstation, and the alert goes to your outside security provider. Who decides whether to open an incident, and how quickly?
Listen for
- Clear rules for when an alert becomes an incident
- The provider's alerts reaching someone with authority
- A record of what was decided and why
Leadership
Ransomware is spreading, and the only way to contain it is to switch off IT across every hospital. Who can make that call, and what keeps patients safe while you do?
Listen for
- Authority to shut everything down, set in advance
- Paper processes ready for critical services
- Clinical leaders in the decision
Board
The independent review says no senior executive was responsible for cybersecurity. What does the board change, and how will it check it worked?
Listen for
- A named executive accountable for cyber risk
- Regular reports to the board
- An outside review on a set schedule
-
Apr 2021 Murphy Battista LLP · British Columbia, Canada A law firm hit by ransomware was replaced as counsel on the class action it was running.
What happened
In early April 2021 the firm, which represented taxpayers in a class action over the 2020 government account breaches, suffered what the Federal Court described as a ransomware attack. Its network was said to be secure again by June 24, 2021.
Impact
The federal government told the court it planned to claim against the firm for harm to class members caught in both breaches, and to seek its removal as counsel over a conflict of interest. The firm was replaced in December 2021, and the plaintiff narrowed the claim to keep the case in Federal Court (Federal Court, 2021 FC 1449).
Sources: Federal Court, 2021 FC 1449, Government of Canada notice
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Your file server is encrypted, and it holds client documents for live litigation. What do you need to prove about what the attackers could reach, and how do you keep that proof?
Listen for
- A list of the matters and clients on the affected systems
- Evidence kept in a way that would stand up in court
- A date you can defend for when the network was clean
Leadership
The other side learns about your breach and says it will ask the court to remove you as counsel. Who decides whether you stay on the file, and what do you tell the client?
Listen for
- The client told before they hear it from anyone else
- An outside view on the conflict, not only your own
- A plan for handing over the file if it comes to that
-
Mar 2021 Sierra Wireless · British Columbia, Canada Ransomware stopped production, and the company withdrew its financial guidance.
What happened
Sierra Wireless said ransomware hit its internal IT systems, disrupting its website and operations and halting production at its manufacturing sites. Production resumed six days later.
Impact
The company withdrew the quarterly guidance it had issued a month earlier (company releases).
Sources: Company release, Company release
Use it in your tabletop
Technical team
Ransomware has hit your office systems, and the plant shares the network. Do you stop production to protect it, and how do you decide what is safe to restart?
Listen for
- Plant systems kept apart from office systems
- A safe-restart checklist
- Engineering and IT deciding together
Leadership
Production has stopped. Your largest customer wants a delivery date today. What can you promise, and who signs off on it?
Listen for
- No promise you can't keep
- One person who speaks to key customers
- A time for the next update
Board
Finance asks whether investors or lenders need to hear about this. Who decides what is material, and how quickly?
Listen for
- Disclosure duties known before the day
- Legal and finance in the decision
- The board told before the market
-
Jan 2021 Edmonton Meals on Wheels · Alberta, Canada A charity's whole database was on a stolen backup drive, and it wasn't encrypted.
What happened
The charity called Edmonton police on January 7, 2021 after realizing a backup hard drive holding all its data had been stolen from its office. It first believed the data was encrypted, then found it was not (CBC).
Impact
The drive held personal information on more than 27,000 clients, donors, volunteers and employees, who were told in early June, about five months after the theft (CBC). The charity offered a year of credit monitoring and moved its data to a secure cloud service (Alberta privacy commissioner).
Sources: CBC, Alberta privacy commissioner
Use it in your tabletop
Technical team
A backup drive holding your whole database is missing from the office. Was it encrypted, and how do you know for sure?
Listen for
- Encryption checked, not assumed
- A list of everything that was on the drive
- Backups kept where nobody can walk off with them
Leadership
Months after a theft, you learn the stolen data wasn't encrypted after all. What do you tell clients, donors and volunteers, and how do you explain the delay?
Listen for
- A plain account of what happened and when you knew
- What people should watch out for
- Help offered, such as credit monitoring
Board
The law may not require you to report this. Does the board decide to tell the people affected and the privacy commissioner anyway?
Listen for
- A decision based on harm to people, not the legal minimum
- The decision and its reasons recorded
- A look at what data you keep but don't need
-
Dec 2020 TransLink · British Columbia, Canada A transit agency kept buses running while payments and staff systems went down.
What happened
TransLink said attackers hit parts of its IT network and communicated through a printed message. It shut down key systems to contain the attack. Payment systems were disrupted while transit kept running.
Impact
TransLink told employees that payroll files, including banking details and some social insurance numbers, may have been copied, and offered two years of credit monitoring (BleepingComputer).
Sources: TransLink statement, BleepingComputer
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Printers across the office start printing a ransom note. Who is allowed to take the network offline, and who do they call first?
Listen for
- A named person with authority to disconnect
- The incident lead and outside help called within the hour
- Operations kept apart from office systems
Leadership
Day 2. Payroll files may have been copied, and payday is Friday. How do you pay everyone on time, and what do you tell staff who ask whether their bank details are safe?
Listen for
- A backup way to run payroll
- An honest answer about what you know
- Credit monitoring offered early
-
Nov 2020 City of Saint John · New Brunswick, Canada A city refused a ransom demand in the millions, rebuilt its network, then sued its insurer.
What happened
The city found ransomware on November 13, 2020 and cut its network off from the internet. Email, phones, the website, emergency dispatch and online payments for parking and permits were hit (CBC, CTV News). City records later showed the network had been breached about two weeks before the attack (CBC).
Impact
A councillor said the attackers wanted $17 million to $20 million in bitcoin. The city built a new network instead, at about $2.9 million, with 85 per cent covered by insurance (CBC, 2021). In 2022 council voted to sue its insurer, AIG Canada, over the costs (CBC).
Sources: CBC (2021), CBC (2022), CBC (city records), CTV News
Use it in your tabletop
Technical team
Forensics say the attackers were inside for two weeks before anything was encrypted. What do you assume they took, and do you repair the network or rebuild it?
Listen for
- Anything they could reach treated as copied until shown otherwise
- Repair or rebuild decided on evidence
- Logs kept for police and the insurer
Leadership
Online payments, permits and your website will be down for weeks. Which services move to phone, counter or paper, and who tells residents?
Listen for
- Services ranked in advance
- One public channel with set update times
- Fees and deadlines paused where people can't pay
Board
The demand is in the millions. What does council decide about paying, and who keeps an eye on the insurance claim from day one?
Listen for
- A stance on paying that council owns
- The insurer told early, in the way the policy requires
- Costs tracked against the policy as they come in
-
Aug 2020 Canada Revenue Agency and GCKey · Federal government, Canada Reused passwords opened thousands of government accounts, and the tax agency shut its online services.
What happened
Attackers used usernames and passwords stolen elsewhere to try 9,041 accounts on GCKey, the sign-in service for about 30 federal departments. About a third got into government services, and about 5,500 Canada Revenue Agency accounts were targeted in that attack and a separate one (Treasury Board statement).
Impact
The CRA disabled the affected accounts, then took its online services down as a precaution, and wrote to people on how to prove their identity and get back in (CBC, Global News). A class action over the breaches was certified by the Federal Court in August 2022 (Government of Canada notice).
Sources: Treasury Board statement, CBC, Global News, Government of Canada notice
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Overnight, sign-ins to your customer portal jump, from addresses you have never seen, and some succeed with the right password. What do you switch on today, and how do you find the accounts that got in?
Listen for
- Extra sign-in checks or rate limits turned on fast
- Accounts with changed bank or contact details found first
- A way to lock and reset without locking everyone out
Leadership
You have disabled thousands of customer accounts, and people can't reach their money. What do you tell them, and how do they prove who they are to get back in?
Listen for
- A message that says what to do, not just what happened
- A way back in that doesn't rely on the stolen password or email
- Call centre staff briefed before the message goes out
-
Aug 2020 Tuckers Solicitors · United Kingdom A criminal defence firm without multi-factor authentication saw court bundles published on the dark web.
What happened
The firm became aware of a ransomware attack on August 24, 2020. It encrypted 972,191 files, including 24,712 relating to court bundles, and the attacker took 60 bundles and published them on underground marketplaces (UK Information Commissioner, via the Law Society Gazette).
Impact
The bundles held medical files, witness statements and the names and addresses of witnesses and victims. The Information Commissioner fined the firm £98,000, finding it had not used multi-factor authentication for remote access and had kept some bundles past their seven-year retention period (Law Society Gazette, Legal Futures, Legal IT Insider).
Sources: Law Society Gazette, Legal Futures, Legal IT Insider
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Your old case files sit unencrypted on an archive server that staff reach remotely with just a password. What changes first?
Listen for
- A second factor on remote access
- Old files deleted when the retention period ends
- Sensitive archives encrypted
Leadership
Court bundles naming victims and witnesses are on the dark web. Who do you tell, and in what order: clients, the courts, the regulator?
Listen for
- Regulator deadlines tracked from the hour you knew
- Clients told before they read about it
- Support for victims and witnesses named in the files
-
May 2020 BC Cancer Foundation and other charities (vendor: Blackbaud) · British Columbia and Ontario, Canada A fundraising software vendor paid a ransom, and Canadian charities had to tell their donors.
What happened
Blackbaud, which hosts fundraising data for charities, was hit by ransomware in May 2020 and posted a notice several weeks later. Canadian charities including the BC Cancer Foundation and the CAMH Foundation then told donors their information may have been taken (CTV News, The Canadian Press).
Impact
The BC Cancer Foundation said names, addresses, emails, phone numbers, demographic details and donation history may have been accessed, but no card details. It said Blackbaud paid a ransom in exchange for the data being deleted (CTV News).
Sources: CTV News, Global News, Alberta privacy commissioner
Use it in your tabletop
Technical team
Your fundraising software provider says it was hit by ransomware and your donor data was taken from its backups. What do you need from them, and what do you check on your side?
Listen for
- Exactly which fields and dates were taken
- The provider's findings in writing
- Your own exports and old records reviewed
Leadership
Weeks after the attack, the vendor tells you it paid the attackers to delete your donors' data. What do you tell donors, and do you take the vendor's word for it?
Listen for
- Donors told what was and wasn't taken
- The deletion claim treated as unproven
- A warning about phishing that uses donor details
Board
Most of your donor data sits with one vendor. What does the board want checked in that contract, and should the data stay there?
Listen for
- How fast the vendor must tell you about a breach
- Security terms the board has actually seen
- Whether you hold more donor data than you need
-
Oct 2019 LifeLabs · Ontario and British Columbia, Canada A lab company paid attackers to get back stolen data on millions of customers.
What happened
LifeLabs spotted suspicious activity on October 28, 2019. Three days later the attackers emailed to say they would publish the data unless paid, and after asking them to back up their claims, LifeLabs paid (Ontario and BC privacy commissioners).
Impact
The commissioners said the data related to about 8.6 million customers, mainly in Ontario and BC. They found LifeLabs had not put reasonable safeguards in place and had collected more than it needed, and ordered it to stop collecting some information (Ontario and BC privacy commissioners, Global News).
Use it in your tabletop
Technical team
An attacker emails to say they have your customer database and offers to prove it. How do you test the claim, and what do you preserve while you do?
Listen for
- Their proof checked against your own records
- Logs and access records preserved
- Outside forensics brought in through legal counsel
Leadership
Millions of customers may be affected. Do you notify now with what you know, or wait until you can say exactly who was hit?
Listen for
- Regulators told within the required time
- A first notice that says what you don't know yet
- Call centre ready before the announcement
Board
Management recommends paying to get the data back and keep it off the internet. What does the board ask before agreeing?
Listen for
- What paying buys, and what it can't
- Law enforcement and sanctions advice
- How the decision will look to regulators and customers
-
Jun 2019 Desjardins Group · Quebec, Canada An employee copied members' data for over two years before police noticed.
What happened
The federal privacy commissioner said an employee in the data department copied personal information for at least 26 months. Desjardins learned of it from police during an unrelated investigation.
Impact
The commissioner said close to 9.7 million people were affected and found the safeguards inadequate, including no data loss prevention or USB controls (OPC, 2020).
Sources: OPC findings, CBC
Use it in your tabletop
Technical team
Police call. They found your customer files on a suspect's device, and nothing on your side ever raised an alert. Where do you look first, and what do you lock down today?
Listen for
- Who could reach that data, and what they copied
- Controls on USB drives and bulk exports checked
- Evidence kept for police and regulators
Leadership
Millions of members may be affected, and the count keeps rising. What do you tell them first, and what do you offer?
Listen for
- A first notice that admits the count may grow
- Protection offered, such as credit monitoring
- A call centre ready before the notice goes out
Board
The board asks how one trusted employee copied data for two years without anyone noticing. Who answers, and what will you commit to change?
Listen for
- A straight account of the gaps
- An outside review of the privacy and security program
- A date and an owner for each fix
-
May 2019 City of Baltimore · Maryland, US Ransomware left a city unable to send water bills for weeks.
What happened
City employees found ransom messages after parts of Baltimore's systems were encrypted. The city refused to pay. Email, billing and property sales ran on workarounds for weeks.
Impact
The city budget office estimated the cost at $18.2 million, including deferred and lost revenue (NBC Washington, citing The Baltimore Sun).
Sources: NBC Washington, Maryland Matters
Use it in your tabletop
Technical team
Most staff have lost email and computers, and billing systems are encrypted. What comes back first, and how do you know a restored server is clean?
Listen for
- A restore order based on services, not servers
- Systems checked before they reconnect
- Clean backups kept apart from the network
Leadership
Billing is down and you can't send invoices for a month. How long can you run without that revenue, and what happens to late fees?
Listen for
- Cash flow worked out in advance
- Fees and penalties paused where people can't pay
- A plan to catch up on billing
Board
The ransom demand is far smaller than the recovery bill. The board asks why you won't just pay. Answer them.
Listen for
- What paying would and wouldn't fix
- Law enforcement advice
- The board's decision on the record
-
May 2019 City of Burlington · Ontario, Canada One email changed a vendor's bank details. The next payment, $503,000, went to a fraudster.
What happened
Staff received an email asking them to update an existing vendor's banking details. The next payment went to the fraudster's account and wasn't caught for a week.
Impact
The city later recovered about 84 per cent of the money through its cyber crime insurance, a civil action and criminal restitution (city statement, reported by CBC in 2023).
Sources: CBC (2019), CBC (2023)
Use it in your tabletop
No board question for this one: nothing in it is the board's to decide. Use the leadership question.
Technical team
Finance forwards an email from a long-standing supplier asking to change its bank details. It came from the supplier's real address. What do you check, and could their mailbox be the one that's compromised?
Listen for
- Message headers and sign-in records checked
- The supplier warned by phone, on a number you already had
- A look for mail rules that forward or hide messages
Leadership
Accounts payable gets new bank details and an urgent invoice from a long-standing supplier. It looks right. What's the rule for checking it, and can anyone override it when a senior manager is pushing?
Listen for
- A call back to a number already on file, never one in the email
- No exceptions for seniority or urgency
- A second person who approves any change to bank details
-
Mar 2019 Norsk Hydro · Norway An aluminium maker refused to pay, ran plants by hand, and kept the public informed.
What happened
On March 19, 2019 ransomware spread across Norsk Hydro, which has 35,000 employees in 40 countries. The company shut down more than 23,000 PCs and 3,000 servers, closed some plants and moved others to manual operations (Idaho National Laboratory case study, Control Engineering).
Impact
The company said it would not pay because it had good, recent backups, and it was praised for being open about the attack throughout. Recovery began about four weeks later, and losses passed US$71 million (SecurityWeek, Control Engineering, Idaho National Laboratory).
Sources: SecurityWeek, Idaho National Laboratory, Control Engineering
Use it in your tabletop
Technical team
Ransomware is spreading faster than you can isolate machines. Do you shut down every computer at once? Who decides, and what does the plant floor need first?
Listen for
- Authority to pull the plug, set in advance
- Plant safety systems checked first
- Clean backups confirmed before any restore
Leadership
Plants are running on paper. What do you tell customers, and how often will you update the public?
Listen for
- A regular public update, even when news is thin
- Honest delivery estimates for customers
- Staff kept informed
Board
Management recommends not paying because the backups are good. What does the board need to hear to back that, and to back being open in public?
Listen for
- Proof the backups are recent and clean
- The likely cost and time to recover
- Why openness helps customers and investors trust you
-
Jun 2017 A.P. Moller-Maersk · Denmark Malware wiped a shipping giant's network, and staff ran operations by hand for ten days.
What happened
In June 2017 NotPetya, malware that looked like ransomware but destroyed data, spread through Maersk's network. The chairman later said the company had to reinstall 4,000 servers, 45,000 PCs and 2,500 applications in ten days, a job he said would normally take six months (SC Media, Supply Chain Dive).
Impact
While the network was rebuilt, transactions were done by hand and freight volume fell by only about 20 per cent. The company put the cost at US$250 million to US$300 million (SC Media, Supply Chain Dive).
Sources: SC Media, Supply Chain Dive
Use it in your tabletop
Technical team
Malware has wiped every server that holds your user accounts and passwords. Is there a copy anywhere that was offline, and how would you rebuild from nothing?
Listen for
- An offline copy of the systems that run sign-in
- A tested plan to rebuild from scratch
- Install media and records kept off the network
Leadership
Your systems are gone for at least a week, but ships are still arriving. Which processes run by hand, and how do customers book with you meanwhile?
Listen for
- The most important processes, with paper versions
- Customers told how to reach you
- Extra staff and hours lined up
Board
The attack wasn't aimed at you; you were caught in a wider one. What does the board ask about how far one attack could spread across your global network?
Listen for
- Networks split so one country can't take down all
- A view of risk from software suppliers
- Insurance terms on war and state-linked attacks
-
May 2016 University of Calgary · Alberta, Canada A university paid a $20,000 ransom to keep the option of recovering its research.
What happened
A ransomware attack in late May 2016 locked university computers and took email and other services down. The university brought in outside experts and the Calgary Police Service (CBC).
Impact
The university said it paid about $20,000 to keep every option for recovering critical data, and that the keys worked but restoring systems would take time. A year on, its vice-president of finance said a breach coach had recommended paying, and that about 10,000 people may have lost something on a server or laptop (CBC).
Sources: CBC (2016), CBC (2017)
Use it in your tabletop
Technical team
You have paid and the decryption keys have arrived. What do you check before you run them, and in what order do systems come back?
Listen for
- Keys tested on copies first
- A restore order agreed with the people who use the systems
- Systems checked for anything the attackers left behind
Leadership
Researchers say years of work are locked, and some of it has no clean backup. Who works out what is really lost, and what do staff hear while you decide?
Listen for
- An inventory of what's affected, with named owners
- An honest message about what may not come back
- A time for the next update
Board
Your breach coach recommends paying a small ransom to keep the option of recovering research. Who approves it, and will you say publicly that you paid?
Listen for
- A board position set before the day
- Legal and sanctions checks done before any payment
- A plan to be open about the decision
No incidents match. Try a broader word, or clear the filters.
How we choose incidents. An incident goes on this list only when the organization, a regulator, a court or a public filing confirmed it, or when at least two major outlets reported it and cited the organization. Every figure is credited to whoever published it. We don't guess at who was behind an attack, or whether a ransom was paid, unless the organization said so.
About the injects. An inject is a new piece of information a facilitator drops into a tabletop exercise to force a decision. Every incident has one for the technical team and one for leadership, and one for the board where the board has a real decision to make. “Listen for” is what a good answer sounds like, so whoever runs the session has something to hold the room's answers against. They are written for an organization like yours, from what each organization here actually faced, and are not a verdict on how any of them handled it.