Coordinated Incident Response for an E-commerce Marketplace
Client: Indian e-commerce marketplace
6h
Reporting window met
Zero
Penalties
First review
Closure
Challenge
A marketplace discovered a credential-stuffing attack exposing partial seller PII, triggering CERT-In notification timelines and customer communication obligations.
Approach
- ·Activated incident response protocol within the CERT-In 6-hour reporting window.
- ·Coordinated with forensic vendor on chain-of-custody documentation.
- ·Drafted customer-facing disclosures balancing transparency and litigation exposure.
Outcome
- ·CERT-In notification filed within mandated window with full evidentiary record.
- ·Zero regulatory penalties imposed; matter closed at first review.
- ·Customer disclosure praised by industry observers as a template for proportionate response.
Counsel's Takeaway
"Incident response is a legal workflow before it is an engineering one — the playbook must exist before the breach."
Confidential · 30-minute discovery call