← VCE Data Analytics U4O2

Ethical issue: lack of transparency after a cyber security incident

Hiding, delaying or downplaying news of a cyber incident, so affected people cannot protect themselves and trust in the organisation is broken. Honest, timely disclosure avoids this.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 142, WA Computer Science ATAR Year 11 — Cyber Security — Module 168

Understanding Ethical issue: lack of transparency after a cyber security incident in VCE Data Analytics U4O2

What it does: Calling a major breach 'a small issue' is downplaying. People underestimate the danger and do not take steps to protect themselves. Delaying news means customers cannot change passwords or watch their accounts, and trust in the organisation is broken. Without knowing about the breach, people cannot act to reduce the risk of fraud or identity theft. People expect organisations to be open about how their data is handled, so hiding an incident breaks that trust. Delayed disclosure is a form of non-transparency. Every day of delay gives criminals more time to misuse the stolen data before people can act. Waiting to be found out is deliberate concealment. Ethical practice is to tell affected people as soon as possible.

Common mistakes: The notice must be sent when a breach has happened. With FALSE, customers are only told when there is no breach, so the incident stays hidden. It should be IF breach = TRUE THEN. This downplays the incident. The message should describe what really happened so people understand the risk. It should be message ← incident.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Ethical issue: lack of transparency after a cyber security incident to a class →

This module's key terms are also in a printable crossword (Modules 135–150) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

A company discovers a breach but waits three months before telling customers. What ethical issue does this show?

Good practice: protecting the brandLack of transparency: delayed disclosure

Matches

We will wait until the media finds out before telling customers about the breach.

↓

Hiding the incident until it is exposed denies customers the chance to protect themselves and destroys trust when the truth emerges. The organisation should disclose honestly and promptly.

Applying

Meanings

Term

Lack of transparency

Meaning

Hiding, delaying or downplaying news of a cyber incident, so affected people cannot protect themselves and trust in the organisation is broken. Honest, timely disclosure avoids this.

Practice

IF breach_confirmed THEN

Testing

Gaps

delayed .

Check Answer

Spots

1IF breach = FALSE THEN

2 SEND notice TO customers

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A company discovers a breach but waits three months before telling customers. What ethical issue does this show?

A. Lack of transparency: delayed disclosure ✓

B. Good practice: protecting the brand

Delaying news means customers cannot change passwords or watch their accounts, and trust in the organisation is broken.

2. Which response to a breach shows honest and timely communication?

A. Telling affected people promptly what happened and what data was involved ✓

B. Waiting until media reports force a statement

Prompt, clear disclosure lets people protect themselves, which is the opposite of hiding or delaying news.

3. An organisation says 'a small technical issue occurred' when 500,000 customer records were stolen. This is:

A. Downplaying the incident ✓

B. Honest communication

Downplaying makes a serious incident sound minor, so people do not take steps to protect themselves.

4. Why does hiding a breach harm affected people?

A. They automatically receive compensation

B. They cannot take steps to protect themselves, such as changing passwords ✓

Without knowing about the breach, people cannot act to reduce the risk of fraud or identity theft.

5. What is the likely effect of a lack of transparency on trust in an organisation?

A. Trust increases because the organisation seemed calm

B. Trust is broken when the hidden breach is discovered ✓

People expect organisations to be open about how their data is handled, so hiding an incident breaks that trust.

Match the Pairs

Lack of transparency → Hiding, delaying or downplaying news of a cyber incident so affected people cannot protect themselves

Delayed disclosure → Waiting weeks or months to tell customers about a breach, so they cannot change passwords or watch their accounts in time

Downplaying an incident means describing a serious breach as minor, which misleads affected people about the risk they face → Notice: 'A small issue occurred' (when 2 million records were stolen)

Honest and timely communication tells affected people what happened, what data was involved and what to do, as soon as it is known → Notice: 'Breach on 3 May. Names and emails taken. Change your password today.'

We will wait until the media finds out before telling customers about the breach. → Hiding the incident until it is exposed denies customers the chance to protect themselves and destroys trust when the truth emerges. The organisation should disclose honestly and promptly.

Customer email: 'Some data may have been accessed. There is no need to take any action.' → The message downplays the incident and gives no useful detail, so customers do not know what was exposed or how to protect themselves. It should name the data involved and advise actions such as changing passwords.

Key Term

Lack of transparency

Hiding, delaying or downplaying news of a cyber incident, so affected people cannot protect themselves and trust in the organisation is broken. Honest, timely disclosure avoids this.

Fill in the Blanks

1. Waiting weeks to report a breach is delayed disclosure.

Hint: Type the word for telling people about an incident

2. Calling a breach 'minor' is downplaying.

Hint: Type the word for making a serious incident sound smaller than it is

3. Honest, timely communication builds trust.

Hint: Type the word meaning done quickly, without delay

4. IF breach = TRUE THEN notify(affected_people) END IF

Hint: Type the function name that tells people about the breach

5. Hiding a breach stops people protecting themselves and breaks trust in the firm.

Hint: Type the word for the confidence people place in an organisation

Spot the Error

Question 1

A IF breach = FALSE THEN

B SEND notice TO customers

C SAY what data was lost

D END IF

Line A — The notice must be sent when a breach has happened. With FALSE, customers are only told when there is no breach, so the incident stays hidden. It should be IF breach = TRUE THEN.

Question 2

A incident ← 'data stolen'

B message ← 'minor glitch'

C SEND message TO customers

Line B — This downplays the incident. The message should describe what really happened so people understand the risk. It should be message ← incident.

Question 3

A found ← TRUE

B IF found THEN

C HIDE alert FROM affected

D END IF

Line C — Hiding the alert stops affected people from protecting themselves. Honest disclosure means sending it. It should be SEND alert TO affected.

Question 4

A WHILE incident = OPEN

B post update next year

C answer customer questions

D END WHILE

Line B — Waiting a year is delayed disclosure. Updates should be frequent and timely while the incident is open. It should be post update every day.

Question 5

A message ← 'Nothing to report'

B SEND message TO customers

C LOG 'Customers told'

Line A — The message denies the incident, which is not transparent. It must state the truth, for example 'Data was stolen'.

Student with a class code? Join your class →