Ethical issue: lack of transparency after a cyber security incident

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A company discovers a breach but waits three months before telling customers. What ethical issue does this show?

A Lack of transparency: delayed disclosure

B Good practice: protecting the brand

2. Which response to a breach shows honest and timely communication?

A Telling affected people promptly what happened and what data was involved

B Waiting until media reports force a statement

3. An organisation says 'a small technical issue occurred' when 500,000 customer records were stolen. This is:

A Downplaying the incident

B Honest communication

4. Why does hiding a breach harm affected people?

A They automatically receive compensation

B They cannot take steps to protect themselves, such as changing passwords

5. What is the likely effect of a lack of transparency on trust in an organisation?

A Trust increases because the organisation seemed calm

B Trust is broken when the hidden breach is discovered

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Lack of transparency		AHiding, delaying or downplaying news of a cyber incident so affected people cannot protect themselves
2Delayed disclosure		BHiding the incident until it is exposed denies customers the chance to protect themselves and destroys trust when the truth emerges. The organisation should disclose honestly and promptly.
3Downplaying an incident means describing a serious breach as minor, which misleads affected people about the risk they face		CNotice: 'A small issue occurred' (when 2 million records were stolen)
4Honest and timely communication tells affected people what happened, what data was involved and what to do, as soon as it is known		DWaiting weeks or months to tell customers about a breach, so they cannot change passwords or watch their accounts in time
5We will wait until the media finds out before telling customers about the breach.		EThe message downplays the incident and gives no useful detail, so customers do not know what was exposed or how to protect themselves. It should name the data involved and advise actions such as changing passwords.
6Customer email: 'Some data may have been accessed. There is no need to take any action.'		FNotice: 'Breach on 3 May. Names and emails taken. Change your password today.'

Definitions

Lack of transparency

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Waiting weeks to report a breach is delayed __________.

Calling a breach 'minor' is ___________.

Honest, ______ communication builds trust.

IF breach = TRUE THEN ______(affected_people) END IF

Hiding a breach stops people protecting themselves and breaks _____ in the firm.

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF breach = FALSE THEN

B SEND notice TO customers

C SAY what data was lost

D END IF

Question 2

A incident ← 'data stolen'

B message ← 'minor glitch'

C SEND message TO customers

Question 3

A found ← TRUE

B IF found THEN

C HIDE alert FROM affected

D END IF

Question 4

A WHILE incident = OPEN

B post update next year

C answer customer questions

D END WHILE

Question 5

A message ← 'Nothing to report'

B SEND message TO customers

C LOG 'Customers told'

Answer Key

Ethical issue: lack of transparency after a cyber security incident

Section A: Quick Questions

A — Lack of transparency: delayed disclosure

A — Telling affected people promptly what happened and what data was involved

A — Downplaying the incident

B — They cannot take steps to protect themselves, such as changing passwords

B — Trust is broken when the hidden breach is discovered

Section B: Match the Pairs

Lack of transparency → Hiding, delaying or downplaying news of a cyber incident so affected people cannot protect themselves

Delayed disclosure → Waiting weeks or months to tell customers about a breach, so they cannot change passwords or watch their accounts in time

Downplaying an incident means describing a serious breach as minor, which misleads affected people about the risk they face → Notice: 'A small issue occurred' (when 2 million records were stolen)

Honest and timely communication tells affected people what happened, what data was involved and what to do, as soon as it is known → Notice: 'Breach on 3 May. Names and emails taken. Change your password today.'

We will wait until the media finds out before telling customers about the breach. → Hiding the incident until it is exposed denies customers the chance to protect themselves and destroys trust when the truth emerges. The organisation should disclose honestly and promptly.

Customer email: 'Some data may have been accessed. There is no need to take any action.' → The message downplays the incident and gives no useful detail, so customers do not know what was exposed or how to protect themselves. It should name the data involved and advise actions such as changing passwords.

Section C: Definitions

Lack of transparency — Hiding, delaying or downplaying news of a cyber incident, so affected people cannot protect themselves and trust in the organisation is broken. Honest, timely disclosure avoids this.

Section D: Fill in the Blanks

Waiting weeks to report a breach is
delayed disclosure.

Calling a breach 'minor' is downplaying.

Honest, timely communication builds trust.

IF breach = TRUE THEN
    notify(affected_people)
END IF

Hiding a breach stops people protecting
themselves and breaks trust in the firm.

Section E: Spot the Error

A — The notice must be sent when a breach has happened. With FALSE, customers are only told when there is no breach, so the incident stays hidden. It should be IF breach = TRUE THEN.

B — This downplays the incident. The message should describe what really happened so people understand the risk. It should be message ← incident.

C — Hiding the alert stops affected people from protecting themselves. Honest disclosure means sending it. It should be SEND alert TO affected.

B — Waiting a year is delayed disclosure. Updates should be frequent and timely while the incident is open. It should be post update every day.

A — The message denies the incident, which is not transparent. It must state the truth, for example 'Data was stolen'.