Subject: Preliminary Security Incident Notice – Object Storage Misconfiguration (First Hour)
External (customers/partners/public)
Purpose
Provide a factual, time-bound update while investigation is ongoing. This is a holding statement for the first hour.
Summary
- Incident: An object storage configuration error resulted in public accessibility for approximately three hours.
- Time window: [Start time UTC] to [End time UTC] on [Date].
- Potentially affected data: Phone numbers and delivery addresses associated with certain recent orders.
- Current status: Public access has been disabled. Access keys and credentials have been rotated. Investigation is ongoing.
What we know now
- We have no evidence at this time of malicious activity; however, phone numbers and delivery addresses could have been downloaded during the public accessibility window.
- No passwords, payment card data, or government identifiers are stored in the affected storage location based on our current assessment.
Actions taken
- Closed public access to the affected storage.
- Rotated all related keys/credentials and invalidated cached objects where applicable.
- Initiated forensic review of access logs and content listings.
- Engaged our incident response and privacy teams.
Potential risks and precautions
- Increased risk of targeted phishing, smishing, or delivery-related social engineering.
- We will never request passwords, payment information, or one-time codes via unsolicited calls or messages.
- Recommended actions for customers:
- Be cautious of messages referencing deliveries or orders that ask for additional personal or payment information.
- Verify communications through official channels and report suspicious messages to [support email/portal].
- Contact our support team at [contact details] if you have concerns.
Next steps
- We will provide updates as our investigation confirms scope and impact.
- We will notify relevant authorities and any affected individuals as required by applicable law.
- Contact: [Privacy Office/DPO email], [Support phone], [Incident reference ID].
We regret this incident and are committed to protecting your information. Further details will follow as they become available.
Internal (employees/leadership)
Purpose
Inform employees and key teams within the first hour. Ensure consistent messaging and coordinated action.
Incident summary
- Incident ID: [ID]
- System: Object storage repository [name/identifier], misconfiguration allowed public access.
- Time window: [Start time UTC] to [End time UTC] on [Date] (~3 hours).
- Data potentially accessible: Phone numbers and delivery addresses tied to certain orders. No passwords or payment card data are stored in this repository per current inventory.
- Detection: [Method/source], confirmed at [time UTC].
- Status: Public access disabled; keys and credentials rotated; forensic collection initiated.
Immediate containment and evidence preservation
- Confirm bucket/object ACLs and policies; enforce account-level “public access block.”
- Rotate associated IAM keys/tokens; review any service accounts with access.
- Collect and preserve logs: object storage access logs, CDN/WAF logs, application logs, CloudTrail/audit events, configuration diffs. Maintain chain-of-custody.
- Invalidate CDN caches and remove any publicly cached indexes; check for search engine indexing and request removal if applicable.
- Snapshot affected configuration states and retain for audit.
Investigation priorities (first 24 hours)
- Enumerate objects that were publicly accessible and their data elements.
- Determine whether listing was possible (index exposure) vs. direct object access only.
- Quantify potential exposure: distinct customers, jurisdictions, and time of access.
- Identify any IPs/User-Agents accessing the data during the window; assess anomalous patterns.
- Validate data classifications against our data inventory/records of processing.
- Confirm whether any names or other identifiers were co-located with addresses/phone numbers.
Unified facts and talking points (use verbatim externally and internally)
- “We remediated a configuration error that made certain object storage contents publicly accessible for approximately three hours on [Date/time UTC].”
- “The data potentially accessible includes phone numbers and delivery addresses for a subset of customers. Based on current assessment, no passwords or payment card data were stored in the affected storage.”
- “We have disabled public access, rotated credentials, and initiated a forensic review of logs.”
- “We are assessing risk and will notify relevant authorities and any affected individuals as required by law.”
- “We will provide updates as more information becomes available.”
Action items by function (first hour and remainder of Day 1)
- Security/IR:
- Own incident coordination; maintain incident log.
- Preserve evidence and start timeline reconstruction.
- Analyze access logs to identify potential download/listing events.
- Engineering/Platform:
- Verify and enforce guardrails (e.g., organization-level public access block, policy lints).
- Review Infrastructure-as-Code for misconfiguration; add preventive controls and CI checks.
- Validate object-level permissions and remove residual public ACLs.
- Privacy/DPO/Legal:
- Assess risk to individuals; document assessment and justification.
- Prepare supervisory authority notification under GDPR/UK GDPR within 72 hours if risk is likely.
- Evaluate multi-jurisdictional notification requirements; confirm statutory triggers by region.
- Draft individual notifications and FAQs if required; maintain breach register.
- Customer Support/Comms:
- Use approved script/talking points; do not speculate on counts or root cause.
- Log and escalate any reports of suspicious messages to Security/IR.
- Prepare update cadence and press holding statement aligned with unified talking points.
- Data Operations:
- Identify potentially affected records and map to jurisdictions.
- Validate contact channels for potential notifications.
- Compliance/IT Governance:
- Initiate misconfiguration post-mortem; record corrective actions.
- Verify training/awareness for privileged configuration changes.
Regulatory considerations (for internal planning)
- GDPR/UK GDPR:
- Personal data includes phone numbers and delivery addresses; risk assessment required.
- Notify the competent supervisory authority within 72 hours if the breach is likely to result in risk to the rights and freedoms of natural persons (Art. 33).
- If high risk to individuals is determined, notify affected individuals without undue delay (Art. 34).
- Maintain breach register and documentation of decisions and mitigations.
- United States (example: California):
- California Data Breach Notification Law (Cal. Civ. Code § 1798.82) generally triggers notice when name plus specified sensitive data elements are breached. Phone numbers and addresses alone may not trigger statutory notice; confirm whether names or other enumerated elements were present and assess other states’ definitions.
- Other jurisdictions:
- Validate local breach notification thresholds and timelines (e.g., Canada PIPEDA, Australia Notifiable Data Breaches, etc.) based on residency of affected individuals.
Customer safeguards and guidance (to be used externally and via support)
- Encourage vigilance against smishing/phishing; verify delivery messages through official channels.
- We will not request passwords, payment details, or one-time codes via unsolicited communications.
- Provide contact methods: [support line], [privacy email] for assistance or to report suspicious activity.
Status updates and cadence
- Next internal update: [time UTC], with preliminary scope metrics and regulator notification decision.
- Next external update: [time UTC], or earlier if material facts change.
This communication is intended for first-hour use. Insert confirmed timestamps, contacts, and identifiers before distribution.
