+Crisis Management Briefing Dec. 10th, 2009 8:30 a.m.Corsina Perez and Sarah Laupan
+ Situation Summary Hackers got in to the official Amtrak website and started stealing customers credit card information. By the time it was discovered that our website was compromised (Dec. 10th, 6 a.m.), over 1,200 credit card numbers had been compromised.
+ Background Information Amtrak recently entered into a 5-year outsourcing agreement with AT&T at the end of June 2009. Under the agreement AT&T is our provider of telecommunications networking services, including our managed security services to help protect our telecommunication network infrastructure, including our website and the personal information of our passengers. AT&T Government Solutions Headquarters: 1900 Gallows Road Vienna, VA 22182 703-506-5000
Thursday, Dec. 10th – Day 1+ n 6 a.m. – AT&T securities notifies Amtrak top mgmt of the breach, who then notifies the PR teams. Announcement of meeting at D.C. Union Station offices at 8:30 a.m. for briefing. n 7:30 a.m. – Contacted AT&T to learn current status of situation. Learned that system is no longer vulnerable.Action Taken n 8 a.m. – Contacted FBI cyber crimes division. Corp. Comm. team member Sarah[up to Present Time] Laupan designated in charge of all communication with FBI. Space will be made for agents to work at our HQ and at the AT&T offices. n 8:30 a.m. – Current briefing on overview of action plan.
Thursday, Dec. 10th – Day 1+ n 9 a.m. – 2 Members of Corporate Communications team will be sent to the AT&T offices. Set up of Information Call Center to deal with customer inquiries at our HQ offices at Union Station in D.C. n 9:30 a.m. – Contact credit card companies fraud departments to notifyPlan Overview them of the situation. Decide on plan of action on their part in dealing with accounts. We will get back to them as soon All following plans are as we find out any information about theconsidered tentative and are specific cardholders identities.subject to change based onactual occurrences. We will n 10 a.m. – Draft press release about therespond accordingly to whatever incident. Two plans of action for distribution;situation as it arises. All Immediately at the completion ofcommunication with staff for recovering identities of customers affected,important updates will be issued if on the first day, or early morning of thethrough company e-mail and second day.company mobile phone Corp. Comm. will send out e-mail tocommunication, accordingly. all corporate employees to inform of situation.
Thursday, Dec. 10th – Day 1+ n 11 a.m. – Draft statement to be posted on company website acknowledging security breach. n Late Morning-Early Afternoon – Continue constant communication with AT&T office, FBI investigation, and our HQ. n Late Afternoon-Early Evening – By AT&T sPlan Overview estimate, we expect to have the identified all customers affected by the security breach by late afternoon to early evening. All following plans are All further official plans are based on thisconsidered tentative and are estimate.subject to change based on -Contact credit companies andactual occurrences. We will confirm cancellation and re-issue ofrespond accordingly to whatever affected account numbers.situation as it arises. All -Distribute press release and postcommunication with staff for website statement.important updates will be issued -Announce press conference to bethrough company e-mail and held at Union Station offices at 11 a.m.company mobile phone Friday.communication, accordingly. -Launch Info Call Center. Open till 10 p.m. ET.
Friday, Dec. 11th – Day 2+ n All Day – Information Call Center is open and running; 9 a.m.-10 p.m. ET. Continue constant communication with AT&T. Amtrak team member will be at AT&T s offices for the day. Following up with FBI Investigation as needed. n Morning – Write and start process of sendingPlan Overview out letter of apology to be sent out to each customer affected. All following plans are n 11 a.m. – Press Conference at Union Stationconsidered tentative and are HQ in D.C. given by appointedsubject to change based on spokesperson, Corsina. Press kits will beactual occurrences. We will distributed to media channels present.respond accordingly to whatever Conference will give follow-up details onsituation as it arises. All press release and will take questions.communication with staff forimportant updates will be issued n Afternoon – Dedicated to providingthrough company e-mail and interviews and information to mediacompany mobile phone channels seeking them, headed by officialcommunication, accordingly. spokesperson.
Saturday, Dec. 12th – Day 3+ n All Day – Info Call Center will be open from 9 a.m.-10 p.m. ET. Amtrak team member will wrap up duties at AT&T offices and gather all data collected by AT&T during the investigation. AT&T will be instructed to share any further data with us, as well as the FBI. Continue to assist in FBI investigation as needed.Plan Overview n 9 a.m. – Follow-up briefing with internal staff to go over what the details of the incident All following plans are were and any actions to be followed up on.considered tentative and are Send out follow-up e-mail to corporatesubject to change based on employees and managementactual occurrences. We willrespond accordingly to whatever n Day 3 Afternoon – Top Amtraksituation as it arises. All management will meet with AT&Tcommunication with staff for management to seek answers as to causeimportant updates will be issued and solutions of problem. If AT&T is unablethrough company e-mail and to give us sufficient solutions we may becompany mobile phone seeking to end our agreement/contractcommunication, accordingly. with them and seeking outsourcing our securities elsewhere.
Sunday, Dec. 13th – Day 4+ n All Day – Info Call Center will be open from 9 a.m.-10 p.m. ET. Reduction in staff in the Info Call Center by 7 people. Check in with FBI team in morning and continue to assist in investigation as needed.Plan Overview All following plans areconsidered tentative and aresubject to change based onactual occurrences. We willrespond accordingly to whateversituation as it arises. Allcommunication with staff forimportant updates will be issuedthrough company e-mail andcompany mobile phonecommunication, accordingly.
Monday, Dec. 14th – Day 5+ n All Day – Info Call Center will be open from 9 a.m.-7 p.m. ET. Reduce staff in Info Call Center to 23 people. Update website statement with new Info Call Center hours. Update with FBI concerning the investigation. Goal to wrap-up investigation by Day 7, including having answers as to who is behind the crime. Contact legal department regarding seeking to pressPlan Overview charges against the guilty individual(s). n 10 a.m. – Issue updated Press Release with All following plans are any new information as to how the securityconsidered tentative and are breach happened and any newsubject to change based on developments in updating our securityactual occurrences. We will protocols and settling on a resolutionrespond accordingly to whatever between Amtrak and AT&T.situation as it arises. Allcommunication with staff for n Afternoon – Available for interviews basedimportant updates will be issued on updated press release. Interviews donethrough company e-mail and by spokesperson, Corsina.company mobile phonecommunication, accordingly.
Tuesday, Dec. 15th – Day 6+ n All Day – Info Call Center will be open from 9 a.m.-7 p.m. ET. Reduce staff in Info Call Center by to 17 people. Prepare regular Customer Service Call Center to receive calls from Info Call Center lines starting the next day. Prepare to have calls transferred from Info 1-800 number to Customer Service lines and prepare staff by providing briefing on the status of situation.Plan Overview Continue to wrap up details of investigation with FBI and proceed with process in assisting legal department to All following plans are seek pressing charges.considered tentative and aresubject to change based onactual occurrences. We willrespond accordingly to whateversituation as it arises. Allcommunication with staff forimportant updates will be issuedthrough company e-mail andcompany mobile phonecommunication, accordingly.
Wednesday, Dec. 16th – Day 7+ n All Day – Wrap up final details of FBI s findings from their investigation. Move forward with pressing charges against the accused at fault. We do not plan on releasing any details as to the identity of the individual(s) accused until formal criminal charges have been filed. All calls coming into the Info Call Center number will be programmed toPlan Overview transfer to the Customer Service Call Center. Update website statement to remove Info Call Center 1-800 number and All following plans are to refer all customer inquiries to theconsidered tentative and are Customer Service Call Center number.subject to change based onactual occurrences. We willrespond accordingly to whateversituation as it arises. Allcommunication with staff forimportant updates will be issuedthrough company e-mail andcompany mobile phonecommunication, accordingly.