🧪 Breach-response drill — 2026-Q2-01
SIMULATION — not a real incident. No real user data was exposed. Purpose: exercise
compliance/breach-response.md, measure elapsed time against SLAs, surface gaps.
Scenario
An intern accidentally pastes a tennis match video and its signed download URL into a public Slack workspace thread. The URL is valid for 7 days (our export-style download tokens). Slack message is seen by three non-company members of the channel within 20 minutes.
Timeline (simulated)
| Time (UTC) | Event | Who | Artefact |
|---|---|---|---|
| T+0 | Intern posts link | Intern | Slack msg |
| T+2m | Senior engineer notices; alerts on-call | Eng | #acesense-oncall |
| T+5m | On-call opens incident doc from template | On-call | incidents/2026-Q2-drill-1.md (this file) |
| T+8m | Paging tree notified: Eng Lead + DPO + Founder | On-call | Page logs |
| T+12m | Containment: link revoked by patching the Firebase Storage object's firebaseStorageDownloadTokens metadata (nulling the token invalidates the URL) | Eng Lead | gcloud storage objects update... |
| T+15m | Slack message deleted (on behalf of intern) | Eng Lead | Slack audit |
| T+20m | Access logs pulled for the Storage object: 3 distinct non-internal IPs accessed the file while the URL was live | Eng Lead | Cloud Logging export |
| T+45m | Assessment meeting: data = one tennis video; subjects = 1 user; video does not include children; no special categories other than biometric-adjacent pose (derivable from video) | DPO + Eng Lead | Incident doc §Assessment |
| T+1h | Decision: breach → GDPR Art. 33 notification required (since subject is in DE); subject notification required per Art. 34 (high-risk due to biometric-adjacent exposure) | DPO | Signed decision note |
| T+3h | Art. 33(3) draft completed; internal legal review complete | DPO | Draft attached |
| T+8h | Art. 33 notification submitted to Berlin BfDI via web form | DPO | Confirmation receipt |
| T+12h | Affected user emailed with the Art. 34 notice (plain-language, action-to-take, contact) | DPO | Sent via Resend |
| T+18h | Slack channel access for interns restricted to a read-only audit log | Eng Lead | Slack admin log |
| T+24h | Post-mortem scheduled for T+48h | DPO | Calendar |
Gaps surfaced
-
The paging tree was on-call engineer → manual pings. We should codify a single
page-incidentalias that fans out to Eng Lead + DPO + Founder in one step. Action: add Slack/remindor PagerDuty rotation. Owner: Eng Lead. Due: end of quarter. -
The
firebaseStorageDownloadTokensmetadata patch to invalidate a live URL is not a documented procedure. Action: add a one-liner to the breach runbook's "Containment" section. Owner: Eng Lead. Due: next doc update. -
No automated monitoring detected the URL access pattern (3 new IPs on a single object in a short window). Action: log-based metric + alert on Storage read-count anomalies. Owner: Eng Lead. Due: Q3.
-
The intern had edit access to the Slack workspace by default. No security training onboarding exists. Action: stand up a short-form "what can go on Slack" briefing for new joiners. Owner: Ops. Due: before next intern joins.
-
The simulated Art. 34 email copy referenced technical terms ("signed URL", "storage object"). Action: rewrite the subject-notification template in plain language. Owner: DPO. Due: next doc update.
Time vs SLA
| SLA | Target | Actual (simulated) | Status |
|---|---|---|---|
| Discoverer → on-call paged | ≤ 10 min | 2 min | 🟢 |
| Containment | ≤ 1 h | 12 min | 🟢 |
| Full assessment | ≤ 24 h | 1 h | 🟢 |
| Art. 33 submitted | ≤ 72 h | 8 h | 🟢 |
| Subject notification | ≤ "high risk → without undue delay" | 12 h | 🟢 |
All SLAs met. The gaps identified above are process-improvement items, not timeline failures.
Participants (simulated)
- Discoverer: Senior engineer
- On-call: Eng
- Incident commander: Eng Lead
- Communications: DPO
- Observer / note-taker: Founder
Closure
- Containment complete
- Notifications simulated (no real messages sent)
- Gaps logged as action items above
- Post-mortem scheduled at T+48h (simulated)
- Action items closed (target: end of 2026-Q3)
Drill authenticity statement
This document is a simulation of an incident for training purposes.
No production data was exposed. No real notifications were submitted
to any supervisory authority. No user email was sent. Storage object
mentioned does not correspond to any real file. The drill was run on
2026-04-24 as part of the compliance readiness programme introduced
in compliance/overview.md.
Signed (not yet countersigned):
- Incident commander (simulated role) — AceSense Eng Lead
- DPO (simulated role) — AceSense DPO