Business Email Compromise Crisis

Scenario Overview

Exercise Type: Executive-Level Simulation Exercise Target Audience: C-Suite, Legal Counsel, Finance Leadership, Corporate Communications Scenario: Business Email Compromise Leading to Financial Fraud & Extortion Duration: 120-150 minutes Exercise Objective: Validate executive decision-making during cascading BEC impacts including wire fraud, data extortion, and market instability

---

Facilitator Guidelines

• Force tough prioritization between financial, legal, and reputational risks
• Highlight cross-departmental coordination challenges
• Track regulatory compliance timelines (SEC 8-K filings, GDPR notifications)
• Simulate real-time market reactions and media scrutiny

---

Exercise Script

INJECT 1: Initial Fraud Detection (Day 1 - 08:00 AM)

Situation:

• Treasury team processes three wire transfers per "CFO" email:
  • $2.8M to Bank of Cyprus (Account X)
  • $1.2M to Türkiye İş Bankası (Account Y)
  • $4.5M to Cambodian Commercial Bank (Account Z)
• CFO discovers compromise when missing approval alerts from banking portal
• Bank reconciliation shows payments cleared via SWIFT GPI

Facilitator Notes:

• Observe fraud reversal procedures knowledge
• Note discussions about public disclosure timing

DISCUSSION PROMPT: "What immediate actions with banking partners? When involve law enforcement agencies?"

---

INJECT 2: Email Forensics (Day 3 - 08:00 AM)

Situation:

• Microsoft 365 audit logs reveal:
  • 14 inbox rules forwarding to [email protected]
  • 6,812 emails exfiltrated including:
    • Board meeting minutes with M&A targets
    • Unreleased earnings statements
    • SAP FICO access credentials
• Legal identifies GDPR implications from EU customer data exposure

Facilitator Notes:

• Assess data classification understanding
• Note debates about attorney-client privilege scope

DISCUSSION PROMPT: "What notifications to regulators/data subjects? How contain credential exposure?"

---

INJECT 3: Extortion Escalation (Day 8 - 08:00 AM)

Situation:

• Threat actor communicates via ProtonMail:

  "Pay $50K XMR by 1700 UTC or we release:

  • Q3 earnings leak
  • Client PII database
  • M&A strategy docs"

• Dark web monitoring shows:
  • @BreachAuctionBot tweeting samples with #[WithPCI.com Company Name]Leak
  • 8,400 retweets in first 45 minutes

Facilitator Notes:

• Evaluate ransomware payment decision frameworks
• Note discussions about crisis communication cadence

DISCUSSION PROMPT: "What factors determine ransom payment decision? How coordinate with social media platforms?"

---

INJECT 4: Market Reaction (Day 8 - 08:00 PM)

Situation:

• Financial impacts:
  • NASDAQ halts trading after 18% pre-market plunge
  • S&P downgrades credit rating to BBB-
  • 14 institutional investors file Form 13F-G amendments
• Bloomberg headline:

  "[WithPCI.com Company Name] Cyber Crisis: $8.5M Loss and Counting"

Facilitator Notes:

• Observe investor relations strategies
• Note discussions about Regulation FD compliance

DISCUSSION PROMPT: "What guidance provide to shareholders? How stabilize market position?"

---

INJECT 5: Operational Disruption (Day 10 - 08:00 AM)

Situation:

• Contact center analytics show:
  • 28,000+ robocalls/hour overwhelming IVR
  • Average hold time: 47 minutes
  • 92% abandonment rate
• Confirmed attack vector:
  • SIP INVITE flood from 142 compromised PBX systems

Facilitator Notes:

• Assess telecom infrastructure hardening
• Note discussions about customer alternative channels

DISCUSSION PROMPT: "What emergency contact solutions deploy? How prioritize stakeholder communications?"

---

INJECT 6: Legal Repercussions (Day 12 - 08:00 AM)

Situation:

• Legal department receives:
  • 3 class action filings (CA, NY, IL)
  • FTC Section 5 inquiry notice
  • EU DPA Article 33 non-compliance charge
• Top 5 vendors demand:
  • Third-party security audits
  • $25M escrow for potential damages
  • Contract renegotiations

Facilitator Notes:

• Evaluate litigation hold processes
• Note discussions about insurance coverage limits

DISCUSSION PROMPT: "What terms negotiate with partners? How structure breach cost allocations?"

---

INJECT 7: Long-Term Recovery (Day 30 - 08:00 AM)

Situation:

• Post-incident metrics:
  • $42M total financial impact (direct + indirect)
  • 19% customer churn rate
  • BBB rating downgraded to F
• Security improvements implemented:
  • FIDO2 hardware keys for executives
  • AI-powered email content disarmament
  • Quantum-safe cryptography pilot

Facilitator Notes:

• Focus on brand rehabilitation strategies
• Note discussions about security ROI justification

DISCUSSION PROMPT: "What metrics define recovery success? How transform security culture post-incident?"

---

Exercise Debrief

Strategic Focus Areas:

1. Executive Protection Protocols
2. Material Cybersecurity Event Disclosure
3. Cross-Border Regulatory Navigation
4. Investor Crisis Communication
5. Third-Party Risk Transfer Mechanisms

After-Action Deliverables:

• Revised SEC Form 8-K disclosure playbook
• Executive cyber liability insurance review
• Board-level crisis simulation schedule
• Vendor security covenant framework

Next Steps:

• Conduct tabletop exercise with banking partners
• Implement privileged access management overhaul
• Schedule quarterly investor cybersecurity briefings