Security incident log
Confidential. Do not put passwords, keys or full personal records in this log.
Organisation: Brightwater Analytics
Kept by: Hamza Idrissi, Security Lead
Period: Q1 2029
Incidents
| Number | Date and time found | What happened | Severity | Action | Status |
|---|---|---|---|---|---|
| SEC-007 | 9 Feb 2029 08:40 | Phishing email, 3 staff clicked | Medium | 1 account reset, links blocked | Closed |
| SEC-008 | 21 Feb 2029 17:15 | Laptop lost on a train | High | Remote wipe done, device disabled | Closed |
| SEC-009 | 2 Mar 2029 11:00 | Customer file shared by link | High | Link removed, access log under review | Open |
Data and systems affected
SEC-008: encrypted laptop, no customer data stored locally.
SEC-009: 140 customer contact records, viewed from 3 unknown addresses.
Reports made
SEC-009: regulator told on 3 Mar 2029. Affected customers told on 5 Mar 2029.
Causes
SEC-007: no warning banner on outside email.
SEC-009: sharing links had no expiry.
Fixes and follow-up
| Action | Owner | By when |
|---|---|---|
| Add an outside email banner | Hamza Idrissi | 15 Mar 2029 |
| Set links to expire in 7 days | Omar Khan | 20 Mar 2029 |
Lessons
Staff reported the phishing email within 10 minutes. Reporting works.
Each incident is logged as soon as it is found. Serious ones also get a full post-incident review.