Refresh outage this week: disclosure for your security review

Megan, I want you to hear this from us directly rather than find it yourself. Here's where we are. From Tuesday through Thursday this week we had an outage of the nightly refresh in your evaluation environment. The refresh did not complete on those days, so the brain was answering on older data than you would expect. The outage ended on Thursday. To be transparent, we are still working out the root cause, and we have not yet confirmed whether any records were affected beyond being stale. I would rather tell you that plainly than give you a guess. Hannah is copied and will put the findings in writing as soon as we have them. You asked us to describe any incidents in the last 90 days during the evaluation. Please treat this as that disclosure, and as part of the record for your review. What would you need from us to assess this properly? Tell me and Hannah and we will get it to you. Thanks, Jordan

Jordan, Thank you for disclosing this. For the record, I have noted that the notification came from BB-Demo and that it arrived before our team raised it. To assess this against our risk posture, I need the following in writing: 1. A description of the outage: when it began, when it ended, and which components were affected. 2. Confirmation of whether any data was altered, lost or duplicated, as distinct from being out of date, and how that was verified. 3. The root cause, and the corrective actions taken to prevent a recurrence. 4. Whether the cause has been fully resolved or remains open. Please direct this to me through Hannah's written response. I cannot treat a verbal summary as part of the review file, and a statement that the matter is being addressed on a best-effort basis will not be sufficient. This disclosure does not change the status of the review. It will be considered alongside the open findings. Megan Alvarez, CISO