Kennedys Bermuda Vendor Cyber Rating & Cyber Score

Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with attempted email recall (partially successful), and remediation measures with internal investigation, remediation measures with regulatory reporting (ico, charity commission, sra), remediation measures with apology and communication with affected parties, and recovery measures with incorporating learnings immediately, and communication strategy with public apology, communication strategy with direct contact with affected individuals, communication strategy with statements to media..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Email Addresses and .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: internal investigation, regulatory reporting (ICO, Charity Commission, SRA), apology and communication with affected parties, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by attempted email recall (partially successful) and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through incorporating learnings immediately, .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through investigations by ICO, Charity Commission, and SRA (pending), .

Key Lessons Learned: The key lessons learned from past incidents are importance of email etiquette (CC/BCC usage),need for robust data handling procedures for sensitive cases,immediate recall actions may not fully mitigate leaks.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: The Register, and Source: Independent Inquiry into Child Sexual Abuse (IICSA) 2022 Report, and Source: Information Commissioner's Office (ICO) guidance on email security.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Apology, Direct Contact With Affected Individuals and Statements To Media.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Church Of England Expressed Concern And Is Monitoring The Situation, Direct Communication With Affected Individuals By Kennedys Law and .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Incorporating Learnings Immediately (Unspecified), Potential Policy/Training Updates, .

Most Significant Data Compromised: The most significant data compromised in an incident were email addresses and .

Most Significant System Affected: The most significant system affected in an incident was email system.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was attempted email recall (partially successful).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach was email addresses.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 194.0.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was investigations by ICO, Charity Commission, and SRA (pending), .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was immediate recall actions may not fully mitigate leaks.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was enhanced oversight for communications involving vulnerable groups, regular audits of data handling procedures, implementation of technical controls to prevent mass email leaks (e.g., forced BCC for bulk emails) and mandatory training on email best practices (CC/BCC).

Most Recent Source: The most recent source of information about an incident are Independent Inquiry into Child Sexual Abuse (IICSA) 2022 Report, Information Commissioner's Office (ICO) guidance on email security and The Register.

Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (internal investigation by Kennedys Law; regulatory reviews by ICO, Charity Commission, and SRA).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Church of England expressed concern and is monitoring the situation, .

Most Recent Customer Advisory: The most recent customer advisory issued was an direct communication with affected individuals by Kennedys Law.