When a cyber incident becomes a business crisis
On 29 October 2026, cryptocurrency exchange Binance experienced a major security incident affecting approximately US$6.3 billion in digital assets.¹ According to blockchain analysis cited by Reuters, the bulk of the unauthorised transfers occurred in approximately 20 minutes.²
Binance suspended withdrawals and worked to secure affected infrastructure and trace and freeze assets. Its preliminary findings later indicated that the attacker had gained unauthorised access to an internal wallet-signing service, enabling transactions outside the normal withdrawal process.¹
The incident highlights an important distinction: responding to a cyberattack does not necessarily mean the threat has been fully contained.
While the scale and circumstances were exceptional, the challenge applies to organisations of every size. Leaders may have to make critical decisions with incomplete information, disrupted operations and an uncertain understanding of the threat.
Priority one: Establish control
The early stages of a cyber incident are often characterised by uncertainty. Systems may be inaccessible, the extent of the compromise unclear and the threat still developing.
An effective incident-response plan should identify who can activate emergency procedures, authorise containment measures, coordinate specialists and escalate significant business risks.⁴
Immediate priorities may include isolating affected systems, preserving evidence, securing alternative communications and determining which operations can safely continue.⁴ The objective is to establish control quickly without allowing urgency to replace informed judgement.
Priority two: Communicate clearly
A cyber incident can quickly affect employees, customers, suppliers, insurers and regulators. Organisations should establish who is authorised to communicate, how information will be verified and which stakeholders require updates.
Internally, employees need practical instructions. Externally, communications should clearly distinguish confirmed facts from matters still under investigation.
Where an incident involves personal data, organisations must assess their notification obligations promptly. Under the GDPR, a controller must notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Where the breach is likely to result in a high risk, affected individuals may also need to be informed without undue delay. Organisations should document the breach, their assessment and the basis for any decision not to notify.³
Priority three: Protect essential operations
Containing an attack may require disconnecting systems, restricting access or temporarily suspending services. Businesses should therefore understand which activities are essential, how long interruptions can be tolerated and which workable alternatives are available.⁴
Continuity arrangements might include manual processing, alternative communications or temporary changes to service delivery.
Pressure to restore normal services should not override appropriate security checks. Premature restoration can create further risk where the integrity of systems or data remains uncertain.⁴ The goal should be to maintain critical functions safely while enabling controlled recovery.
Recovery begins before systems are restored
Technical restoration does not necessarily mark the end of an incident. Organisations may still need to verify data integrity, investigate affected transactions and address regulatory, financial or contractual consequences.
Where cyber insurance is in place, businesses should understand relevant notification requirements, policy conditions and procedures for appointing incident-response specialists. Depending on the policy and circumstances, cover may respond to certain investigation, recovery, business interruption or liability costs. The extent of cover will depend on applicable terms, conditions, limits and exclusions.
Would your incident-response plan withstand the first 24 hours?
The best time to identify weaknesses in a response plan is before an attack.
Tabletop exercises allow organisations to test realistic scenarios, clarify decision-making authority and identify gaps in contingency arrangements.⁵ Consider:
- What happens if primary communications are unavailable?
- Who makes critical decisions if senior leaders cannot be reached?
- Can essential services continue if interconnected systems fail?
- How will you confirm that containment measures have worked?
Lessons identified should be assigned to named owners and incorporated into revised procedures.
Cyber resilience is ultimately demonstrated not by the existence of a plan, but by an organisation’s ability to put it into practice under pressure.⁵