Legal Seminar, Denver, CO

Incident Response –Table Top - Scenario

• All computers presenting  ‘ransomware’ message • Logs erased, interactive  access on privileged and  regular accounts • NYDFS and DHS reach out  asking if event occurred • FL, NY, CA and MA data  accessed • FINRA notifies of incident,  facts still developing but  NMLS data likely affected

Incident Response –Table Top – Action/Response

• Declared High Level Incident – Instructions to employees – onsite and offsite – Enlisted Baker & McKenzie; forensics team

– Notified Boards, State commissioners, DHS, FBI, contractors – Prepared and distributed internal/external communications • As additional details unfolded – Provided updates to Boards, commissioners, employees – Notified CFPB, FBI (CHRI) – Contacted AllClear – prepared notification materials; call center details