1. Cybersecurity Preparedness:
A Live Cyberattack Tabletop Exercise

2. Email Received from KrebsOnSecurity
I understand from my sources that you have had a data breach. Later this afternoon, I will be posting a story about it, please let me know if you would like to comment on the following.
“Fitness retailer Gr8t has been the victim of a data breach potentially involving thousands of customer credit card records and other types of personal information. The cybercrime shop —Rescator— has put up for sale a batch of credit cards stolen from the retailer, and claims to also have purchase history files and other sensitive information.”

3. Gr8t Statement
Gr8t is investigating a potential unauthorized access to some customer information. We are working around the clock with a leading forensics firm and a leading law firm to aggressively gather facts and investigate the situation.
Gr8t takes the protection of our customers’ information extremely seriously. It is always our priority to help ensure that our customers have a shopping experience that is as safe and secure as possible, particularly as we investigate and resolve this matter.
Gr8t will provide further updates when we can.

4. Initial Report
Credit Card Information: Taken from about 25,000 users, but it only covers users in about 28 states
User names and passwords: Taken from about 50,000 users, covering 15 states
Name, address, and what they purchased: Taken from about 200,000 users with some overlap in the first two categories, but in most cases, this is the only information the hackers could access
address and performance metrics (such as sleep patterns) for about 100,000 users

5. Email Received by Business Development
Taking your customer files was just the beginning. We have accessed your business development files and now own them. If you pay us $250,000 in Bitcoins by noon tomorrow, we will destroy these files. If not, we will release them to the public. Just to show you we are serious, attached is just one file we have. Reply to this if you are willing to agree to our demands, and instructions will follow.