Cyberattack Response: Key Lessons from Finance Leaders at IMA26 At the Institute of Management Accountants’ 2026 conference in Tampa, Florida, cybersecurity expert Walter Crawford of OakTruss Group led a simulated exercise for finance executives, demonstrating the chaos and critical decisions faced during a supply-chain ransomware attack. The scenario a fictional but realistic breach highlighted gaps in preparedness, the financial toll of downtime, and the complexities of recovery. ### The Attack: A Multi-Pronged Crisis The exercise depicted a double-extortion ransomware attack, where threat actors: - Stole sensitive data (customer records, financial information) before encrypting systems. - Locked employees out of ERP systems, halting invoicing, payroll, and operations. - Demanded payment not only for decryption keys but also to prevent public leaks of stolen data. Finance leaders were forced to act without complete information, balancing immediate business continuity with legal and technical investigations. Crawford emphasized that initial assumptions like relying on untested backups often fail under real-world pressure. ### Key Challenges and Misconceptions 1. Underestimating Recovery Time - Restoring 100+ terabytes of data can take weeks or months, not hours. - Many organizations lack tested backup restoration processes, leaving them vulnerable. 2. Resource Gaps in Incident Response - Most companies have only one or two incident responders insufficient for large-scale breaches. - External specialists (legal, ransom negotiators, forensic teams) are critical but often engaged too late. 3. Legal and Communication Risks - Legal counsel should be involved immediately to manage disclosures, regulatory obligations, and internal leaks. - Rumors and misinformation can escalate damage if not controlled early. 4. Operational Continuity Under Attack - Finance teams must plan for manual workarounds (e.g., payroll, invoicing) when systems are down. - Attackers now operate like corporate entities, with "help desks" and negotiation tactics complicating response efforts. ### Preparation as the Best Defense Crawford stressed that proactive measures not just reactive fixes determine outcomes: - Tested response plans and backup validation reduce downtime. - Pre-established relationships with cybersecurity firms, legal teams, and negotiators improve agility. - Insurance coverage must be reviewed before an incident to avoid gaps in financial protection. Companies that invest in detection and preparedness often mitigate breaches faster or prevent them entirely. Yet, many executives still assume their teams can handle an attack without external support, only to be overwhelmed by the scale and sophistication of modern cybercrime. The exercise underscored a harsh reality: Cyberattacks are not just IT problems they’re business crises, demanding rapid, coordinated action from finance, legal, and operations teams.