with the skill
**Priority: C → B → D → A. Start incident response for C now, and delegate evidence preservation for B while you do it.** Closing the bucket stopped the exposure; it did not resolve the incident or any notification obligations.
These are provisional triage judgments, not legal conclusions. Exposure, jurisdiction, and contract details could change them.
## Triage
| Rank | Matter | Provisional assessment | Action |
|---|---|---|---|
| **1** | **C — Exposed customer records with observed downloads** | **RED / Critical:** severity 5 × likelihood 4 = **20**. Actual exposure, evidence of downloads, authentication-related data, and multiple jurisdictions. | Activate incident response **now**; engage privacy/security outside counsel and forensic support. |
| **2** | **B — Former employee’s overtime allegation** | **ORANGE / High:** severity 4 × likelihood 3 = **12**. Potential wage liability, penalties, fees, and broader exposure if the same practices affected other agents. | Preserve records **today**, investigate promptly, and obtain employment counsel’s assessment. |
| **3** | **D — Renewal at old pricing** | **Likely low-to-medium business/legal priority**, depending on contract value and renewal language. The missed increase is already a commercial issue; additional legal exposure is unquantified. | Review the renewal and pricing provisions after urgent incident work is underway. |
| **4** | **A — Four-year NDA term** | **GREEN / Low:** provisionally severity 1 × likelihood 2 = **2**. A deviation from your template is not inherently a material legal risk. | Log the deviation and manage the obligation; no urgent renegotiation. |
## What to do first: C, in the next hour
1. **Create a small incident team:** you, the engineering/security lead, and the CEO or designated executive. Assign an engineering lead so you are not also running technical remediation.
2. **Call specialist breach counsel and check cyber insurance immediately.** Policy notice requirements,
Show the rest (31 more lines)
approved providers, and consent requirements may affect engagement. Do not let that delay containment or preservation.
3. **Preserve evidence before cleanup destroys it:** cloud and access logs, configuration history, relevant snapshots, download details, and a timestamped incident chronology. Confirm the bucket is no longer public and check for similar exposures.
4. **Establish the facts needed for notification decisions:**
- When did the company first become aware—not just when engineering closed the bucket?
- Which people, countries/states, and customers are affected?
- What was downloaded, and could the IP belong to an authorized service?
- What password hashing algorithm and salting were used? Were any credentials or secrets also exposed?
- Are you acting as controller, processor, or both? Which customer contracts require incident notice?
5. **Start a notification deadline tracker now.** Where GDPR applies, a controller may need to notify the supervisory authority within **72 hours of awareness**, unless the breach is unlikely to risk individuals’ rights and freedoms. A processor must notify its controller without undue delay. Individual notices have a separate high-risk test. California and other applicable laws require their own analysis; **hashed passwords do not automatically eliminate notification obligations**.
6. **Prepare coordinated communications and protective measures.** Assess password resets, session revocation, and credential-stuffing monitoring with engineering. Don’t prematurely tell customers “no misuse” or “no sensitive data.” Don’t delay a required notice until every forensic question is answered.
**Escalation:** Brief the CEO now; determine board reporting with counsel. Review daily until containment, notification decisions, and remediation are under control.
## B: delegate preservation now; investigate today
Ask HR to preserve payroll, timekeeping, schedules, support-system activity, classification records, policies, and relevant messages—including records for similarly situated agents.
- Acknowledge the complaint neutrally and promptly; do not admit liability, argue, or seek a release.
- Confirm work location, duties, exempt/nonexempt classification, actual hours, and pay practices. A job title alone does not establish an overtime exemption.
- Ask employment counsel to evaluate individual **and potential group exposure**, applicable limitation periods, and any required correction.
- Avoid retaliation or instructions that could appear to discourage the complaint.
If the same pay practice remains in use, **review current compliance promptly**, not just the former employee’s claim.
## D and A: handle after the urgent work is staffed
**D:** Confirm renewal effectiveness, pricing-change rights, notice deadlines, and whether sales communicated an agreed increase. Quantify the missed revenue over the renewal term. Don’t backdate notices or invoice a unilateral increase without a contractual basis. Assign renewal-calendar ownership.
**A:** Check whether the term is mutual and whether longer protection benefits your disclosures. Record the four-year obligation and any return/deletion requirements. Unless it creates a specific operational problem, accept the deviation rather than reopening a signed NDA.
**For a solo legal function: your job this morning is to coordinate C and secure specialist help—not personally conduct the forensic investigation while B’s evidence goes unpreserved.**