It’s half past 7 a.m. The chief executive (CEO) of Vulnerable Electric (VE) has just finished a workout in her home gym when she hears the persistent trill of her cell phone in her sweatshirt pocket. She’s used to hearing her phone go off at all hours (she has teenage daughters), but it’s a bit unorthodox for her general counsel to be calling this early. Curious, she picks up.

DISCLAIMER:  This case study depicts a fictional cyber incident based on real-life scenarios described by expert interviewees, media reports, and other publicly available resources. While the details surrounding the characters, company, and ransomware attack are imagined, the business concerns and legal issues raised are plausible and based on actual cases.

Aly McDevitt is Data & Research Journalist at Compliance Week. She has a background in education and college consulting. Prior to teaching, she was an editor/author at Thomson Reuters, where she reported...