with the skill
# Ranking
| Rank | Item | Severity | Likelihood | Score | Level |
|---|---|---|---|---|---|
| 1 | **C**: Public bucket / data exposure | 5 | 5 | **25** | RED |
| 2 | **B**: Overtime claim, lawyer mentioned | 3 | 4 | **12** | ORANGE |
| 3 | **D**: Auto-renewal at old price | 1 | 5 | **5** | YELLOW |
| 4 | **A**: 4-year vs. 3-year NDA term | 1 | 3 | **3** | GREEN |
**Scoring notes**
- **C** is not a hypothetical. Regulated personal data (EU and California) was exposed for 3 weeks, and logs show an unrecognized downloader. Notification clocks may already be running.
- **B** is rated higher than one employee's claim would suggest. Support agents are usually a group, so if she was misclassified or unpaid, others likely were too. That creates collective or class exposure, and possibly PAGA if any are in California. Retaliation risk adds to it.
- **D** is mechanically 10 if you rate severity 2, but the loss is already realized and bounded (about 5% of one year's contract value). It's a commercial issue, not a liability.
- **A** is a one-year longer obligation on a vendor NDA. Log it and move on.
# What to do first: C
**In the next hour or two**
1. **Preserve evidence.** Tell engineering not to delete or modify anything. Snapshot the bucket config, access logs, and any CloudTrail-equivalent records before they roll off. Capture the unknown IP and the download timestamps.
2. **Get outside breach counsel on the phone today.** This is mandatory-tier escalation, and you're a one-person legal team. Have counsel engage the forensic firm so the investigation is better protected by privilege.
Show the rest (28 more lines)
3. **Notify your cyber insurer.** Most policies require prompt notice and may dictate which counsel and forensics vendors you can use. Check before you spend money.
4. **Set up a small response team** (you, the CTO or head of engineering, a comms/exec lead) and keep a written timeline of who knew what and when.
**Within 24 hours**
5. **Establish when you became "aware."** The GDPR 72-hour supervisory authority clock generally runs from awareness, so document that moment carefully and make the notify or don't-notify decision in writing, even if the answer is no.
6. **Identify your role.** Are you a controller or a processor for this data? If you're a processor, your customers' DPAs probably require notice within 24-72 hours, and those deadlines may be sooner than the regulatory ones.
7. **Assess the data.** Names, emails, and hashed passwords can trigger California breach notification, depending on how the statute treats email and password credentials. The hashing algorithm matters a lot (bcrypt with salt vs. MD5). Check the other US states where affected customers live too.
8. **Consider forced password resets** and warnings about credential stuffing, since users reuse passwords. This is also a mitigation that helps your notification analysis.
9. **Hold all external statements** until counsel reviews them. No casual customer replies or Slack speculation.
# Do second: B (about 15 minutes today)
Don't let it wait for C to be finished. Quick steps:
- Send a **litigation hold** to HR, payroll, and IT covering her time records, pay records, schedules, and communications.
- Instruct HR **not to respond substantively or discuss it with her manager**, and **not to take any adverse action**. Route all communication through you.
- This week, pull payroll and time data, check how support agents are classified (exempt vs. non-exempt), and confirm which state she worked in.
- Check for EPLI coverage and its notice requirements. Plan to bring in employment counsel if the records confirm unpaid overtime.
# Can wait: D and A
- **D:** This week, read the renewal clause. Look for price-adjustment rights, notice windows, and whether you can still negotiate an amendment. Tell sales the cause (no renewal calendar or notice process) and set up a renewal-date tracker. Then decide with the business whether it's worth reopening pricing with the customer.
- **A:** Log it in the risk register as GREEN and accept it, unless the NDA also has odd carve-outs or no trade secret tail, which would be worth a quick look. Otherwise, no action beyond noting it.
# Caveats
- I'm assuming the facts as you stated them. The key unknowns for C are the controller/processor role, the hashing method, the affected users' states of residence, and whether the data was actually accessed or just downloaded by a scanner, which forensics should answer.
- This is a risk-triage framework, not legal advice. Have outside counsel confirm the notification obligations, since deadlines depend on jurisdiction and contract terms.
I can draft the litigation hold notice, a breach response timeline, or the risk register entries for all four if you'd like.