The Context
“Please don’t send me anything by email. We are under cyberattack.”
I was about to go to bed when I got Dorina’s message via WhatsApp.
“What the heck is going on? And what do you need?” I responded.
“Let’s talk early tomorrow morning if you can. I’m in over my head. It’s not just us, it’s the whole headquarters. This is one gigantic mess,” she said. We agreed on a time to talk first thing in the morning, then she went off line.
Few people in her company slept that night. The cyberattack was connected to a string of attacks in the country of origin of Dorina’s company headquarters. Such attacks had been more often since Russia’s invasion of Ukraine in February 2022; yet no one could point at the real culprit. But this time the damage was palpable. I was really curious how I would be able to help Dorina during this tough time.
The First Step
“It’s a mess,” she told me, connecting from her private laptop on her home WiFi. “You won’t believe it. They took down our entire email and client database. They are asking for ransom; the official authorities at the headquarters have been involved. Fortunately we have a strong crisis communications team, but even so… here on the ground I am about to face a s**t storm from our clients.”
This was, in fact, our first step. While Dorina needed to trust that their IT team were doing all they could to fix the problem and to keep the executive team informed, her job was to mitigate the impact of the crisis on her customers.
Therefore, the first step we took was to map their stakeholders who could be impacted by the crisis and to score the impact on their business? 1? Not so much right now, it could go worse in the future. 5? Really bad, client operations deeply disrupted.
At the end of this step we emerged with a list of clients qualified by degree of emergency and impact of the cyberattack on their business. We also drafted rough messages that Dorina could use when reaching out to clients. By 9.00 a.m. when clients would come to work, Dorina was ready to reach out personally and tell them what was going on.
The Second Step
Fortunately, the local client database had been stored on an in-house server that hadn’t been impacted by the cyberattack. Only a few authorized people had access to it.
So, Dorina pulled partial and necessary data from the central server into her private computer and she got to work.
Function of the highest emergency and impact, Dorina reached out to each client representative. She informed them personally on what was happening and she told them what was being done to mitigate the negative impact on their business. She took questions and she proposed solutions to clients’ troubles.
The only thing Dorina could not offer their clients was a clear timeline by when this mess would be over.
The Breakthrough
Dorina knew that their real crisis was not the cyberattack, but the risk of losing their clients’ trust. To fix this, she knew she needed to bring all clients into one room.
She reached out to their event manager and she told them: “Before the end of this week I need you to identify the leading cyber expert in our country and to book them for a workshop for our clients. During this workshop I will step up and speak about what happened in our company and what we learnt from it. It won’t be easy, because by then we might not have a solution for them yet. But it needs to be done.”
Said and done. By the end of the week, Dorina’s team managed to gather the representatives of most of their corporate clients in one room for a half-a-day workshop. Dorina presented the situation as clearly as she could following confidentiality rules, and she talked about solutions and lessons learnt.
Equally, the country’s leading cyber expert took companies through what they could expect now that their region was prone to more cyberattacks. Clients received practical advice and healthy warnings on how to anticipate and mitigate the risks of such occurrences on their business. At the end of the workshop they left with a sense of compassion and renewed trust in Dorina and her leadership.
The Resolution
Business came back online in a matter of days. Dorina could not disclose if ransom had been paid or not, but we talked extensively about what she learnt during this crisis- about cybersecurity, about her company, about her clients, and about herself.
After a string of sleepless nights, the situation started to settle. It took, however, several months for the last ripple effect of the cyberattack to be expunged from their system.
Dorina and her company came out stronger from this cyberattack because she recognized her real crisis: not the loss of data, but the potential loss of trust of their customers. By bringing the clients close “to their skin,” Dorina showed compassion and personal interest – and this was returned plentifully by their customers. One year after the cyberattack, the client database was as solid as ever, with almost 0 client churn. Given the high waters rose during the crisis, this could be considered as a massive success.
