The scenario in this record was simulated and never happened. No notification or customer message was actually sent as part of the exercise.

1. Purpose and scope

The tabletop exercise tested Quillmarrow’s breach management plan, B11 v1.0, from initial vendor notification through containment, assessment, a separate decision to notify, preparation of communications and evaluation of lessons.

The exercise followed C.A.R.E.: Contain, Assess, Report, Evaluate, as set out in the PDPC Guide on Managing and Notifying Data Breaches under the PDPA. It was conducted remotely on 21 January 2027 and lasted 90 minutes.

The exercise tested how participants would respond to a reported compromise of web-shop accounts. It did not test live systems or require a real incident response. The simulated assessment and decision below are recorded separately, as required by B11.

2. Participants and roles

The times in the timeline are simulated scenario times, not the times at which actions occurred during the 90-minute exercise.

3. Scenario

On Day 1 at 09:10, Fictional ShopCloud (DV-02) tells Quillmarrow that a credential-stuffing attack has accessed 620 web-shop customer accounts.

The account information comprises names, delivery addresses, phone numbers and order histories. Quillmarrow does not hold payment card data. Participants work from the information available in the scenario and identify what they would need to establish before completing the assessment.

The exercise considers containment with ShopCloud, the scale and potential harm, the notification decision and a possible customer message. The scenario is a test only; it is not a record of an actual attack or breach.

4. Timeline

The timeline records the intended exercise response. The draft and message were exercise materials; nothing was actually sent.

5. Assessment

The DPO completed the simulated assessment on Day 2 at 15:00. It recorded the facts and assessment separately from the subsequent notification decision.

The rules used in the exercise are:

• A data breach is notifiable if it results in, or is likely to result in, significant harm to affected individuals, or is of a significant scale (affects 500 or more individuals).
• The organisation must assess whether a breach is notifiable in a reasonable and expeditious manner.
• If notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days after assessing that the breach is notifiable.
• Where significant harm is likely, notify affected individuals as soon as practicable, on or after notifying the PDPC, subject to the exceptions in the Act.
• A data intermediary processing on Quillmarrow's behalf must notify Quillmarrow without undue delay after it has credible grounds to believe a breach occurred.
• Keep the assessment (facts, scale, harm) separate from the decision to notify (who decides, when, reasons).

The simulated harm view is not a legal conclusion. Quillmarrow should confirm the application of the rules to an actual incident with a Singapore-qualified lawyer.

6. Decision to notify

At Day 2, 16:00, the MD and DPO made and recorded the simulated decision separately from the assessment.

No PDPC notification or customer message was actually sent. The exercise does not establish what the decision would be in a real event; that would depend on its facts and Quillmarrow’s assessment at the time.

7. What worked

The exercise followed the response from vendor report to containment, assessment and decision. The DPO opened a simulated incident record shortly after the report and led the assessment. Containment was discussed with ShopCloud, including password resets and blocking the attacking addresses.

Participants identified the number of affected individuals and used it in the separate decision to notify. The simulated notification draft was ready on Day 3, ahead of the Day 5 deadline. A voluntary customer message with password advice was also prepared.

The exercise exposed weaknesses in the existing plan and form before a real incident. Those findings are recorded below rather than treated as completed fixes.

8. What went wrong

1. Calendar-day timing was initially wrong. Participants first counted 3 working days rather than calendar days for the PDPC notification deadline. The correct exercise deadline was Day 5.
2. ShopCloud’s incident contact was not available. Nobody had the contact to hand during the exercise, creating a potential delay in reaching the vendor.
3. There was no named deputy decision-maker. The MD was simulated as unreachable for two hours, and B11 v1.0 did not name a deputy.
4. Assessment and decision were initially combined. Participants first wrote the facts and the notification decision in one box. They need separate records so that the assessment, decision, timing and reasons can be followed.

9. Lessons and actions

The following actions are covered by DA-14, owned by the DPO and due 15 February 2027. At 31 January 2027, DA-14 was Open, on track.

The MD approved B11 v1.1 on 12 February 2027. This later approval does not alter the DA-14 status recorded at 31 January.

10. Sign-off

Record approved by: Head of Operations (DPO), 22 January 2027

Noted by: Managing Director, 12 February 2027

The next drill is planned for July 2027.