Question

During an active ransomware incident, a local news outlet publishes a story claiming your company suffered a major breach exposing customer data. Employees begin fielding calls from customers and reporters, and one engineer posts a technical detail about the attack on a public forum. As the CySA analyst supporting the incident, what is the MOST appropriate action to ensure consistent and accurate external communication?

Accepted Answer

Direct all external inquiries and any public statements to the designated public relations/communications team working with legal, and instruct staff not to disclose incident details

Answer

Have the incident response team publish a detailed technical timeline of the attack on the company website to demonstrate transparency

Answer

Authorize each department head to respond to media questions relevant to their area to speed up the response

Answer

Instruct the engineer to correct any inaccuracies about the attack directly on the public forum to control the narrative