DISCLAIMER: This case study depicts a fictional cyber incident based on real-life scenarios described by expert interviewees, media reports, and other publicly available resources. While the details surrounding the characters, company, and ransomware attack are imagined, the business concerns and legal issues raised are plausible and based on actual cases.

Betsy was devastated. She had single-handedly invited a criminal into her company’s inner sanctum. She might as well have opened the door of the office building to a thief and offered him (or her—it took all sorts, she reminded herself) a cup of coffee. She felt like she’d just betrayed a family member.

On that dreadful morning, she called her boss to tell him what happened—the email marked “urgent,” the typo in the email sender name, the link, the phony website, the skull and crossbones, the whole bit. She was sure he was going to fire her on the spot.

When she finally stopped speaking, she heard heavy silence on the line. She thought maybe he’d hung up on her.