Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach and Ransomware.

Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with forced password reset, and communication strategy with customer notification, and containment measures with network segmentation, containment measures with access controls review, and remediation measures with immediate patching, remediation measures with version audits, and and and and third party assistance with managed service providers (83% of organizations), third party assistance with cybersecurity assessments of software suppliers (91%), and remediation measures with cloud security enhancements (68% priority), remediation measures with network protection (60% priority), remediation measures with backup technologies (58% priority), and recovery measures with ransomware recovery plan testing (76% test multiple times/year), recovery measures with security awareness training (80% conduct regularly)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Websocket endpoint: /rhn/websocket/minion/remote-commands and third-party service providerssoftware supply chainAI-driven phishing/deepfake attacks.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are User Credentials, Personally Identifiable Information (Likely), Corporate Data, Financial Data (Possible) and .

Third-Party Assistance: The company involves third-party assistance in incident response through managed service providers (83% of organizations), cybersecurity assessments of software suppliers (91%), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Immediate patching, Version audits, , cloud security enhancements (68% priority), network protection (60% priority), backup technologies (58% priority), .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by forced password reset, network segmentation, access controls review and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through ransomware recovery plan testing (76% test multiple times/year), security awareness training (80% conduct regularly), .

Key Lessons Learned: The key lessons learned from past incidents are AI adoption outpaces governance: 95% allow generative AI tools, but only ~50% have formal AI-use/data privacy policies.,Third-party risks are critical: 66% of organizations impacted by vendor/managed services breaches in the past year.,Recovery confidence is misplaced: 98.6% express confidence in recovery, but only 12% fully recover data post-attack.,Board-level engagement is rising: 84% of Indian executives now rank ransomware as a top-three business risk (vs. 71% globally).,Collaboration is key: Effectiveness depends on shared responsibility across organizations, partners, and technology providers.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: OpenText Global Ransomware Survey (4th Annual), and Source: ETCISO Article on OpenText Survey Findings.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Customer notification.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Board-Level Engagement: 84% Of Indian Executives Treat Ransomware As A Top-Three Business Risk. and Third-Party Advisories: 91% Conduct Formal Cybersecurity Assessments Of Software Suppliers..

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Managed Service Providers (83% Of Organizations), Cybersecurity Assessments Of Software Suppliers (91%), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Forced password reset, Accelerate Implementation Of Ai Governance Frameworks And Data Privacy Policies., Enhance Third-Party Risk Management Programs, Including Continuous Monitoring Of Suppliers., Increase Frequency And Rigor Of Ransomware Recovery Simulations., Invest In Advanced Threat Detection For Ai-Driven Attacks (E.G., Deepfake Identification Tools)., Promote Cross-Industry Collaboration To Address Systemic Vulnerabilities In Supply Chains., .

Ransom Payment History: The company has Paid ransoms in the past.

Last Attacking Group: The attacking group in the last incident was an Third-party attacker.

Most Significant Data Compromised: The most significant data compromised in an incident were User Data and .

Most Significant System Affected: The most significant system affected in an incident was Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1SLES15-SP4-Manager-Server-4-3-BYOS (all variants)SLES15-SP4-Manager-Server-4-3-BYOS-AzureSLES15-SP4-Manager-Server-4-3-BYOS-EC2SLES15-SP4-Manager-Server-4-3-BYOS-GCESUSE Manager Server Module 4.3 and .

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was managed service providers (83% of organizations), cybersecurity assessments of software suppliers (91%), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Forced password reset and Network segmentationAccess controls review.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach was User Data.

Highest Ransom Paid: The highest ransom paid in a ransomware incident was 70% of affected organizations.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Collaboration is key: Effectiveness depends on shared responsibility across organizations, partners, and technology providers.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor for suspicious activity, Foster cross-ecosystem collaboration to address cascading risks in supply chains and shared infrastructure., Strengthen third-party risk management, including rigorous cybersecurity assessments of suppliers and managed service providers., Expand security awareness training to include AI-specific threats (e.g., deepfakes, generative AI misuse)., Implement formal AI governance frameworks to align productivity gains with security/privacy risks., Prioritize investments in cloud security, network protection, and immutable backup solutions., Enhance ransomware recovery testing frequency and realism to close the gap between perceived and actual resilience. and Prioritize immediate patching.

Most Recent Source: The most recent source of information about an incident are OpenText Global Ransomware Survey (4th Annual) and ETCISO Article on OpenText Survey Findings.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Survey-based findings (no specific incident investigation detailed).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Board-level engagement: 84% of Indian executives treat ransomware as a top-three business risk., Third-party advisories: 91% conduct formal cybersecurity assessments of software suppliers., .

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Websocket endpoint: /rhn/websocket/minion/remote-commands.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Password Reuse, Missing Authentication for Critical Function (CWE-306), Rapid AI adoption without commensurate governance (e.g., lack of formal AI-use policies).Over-reliance on third-party ecosystems with inadequate security oversight.Insufficient testing of ransomware recovery plans (gap between confidence and actual recovery rates).Expanding attack surface due to hybrid/AI-powered environments..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Forced password reset, Accelerate implementation of AI governance frameworks and data privacy policies.Enhance third-party risk management programs, including continuous monitoring of suppliers.Increase frequency and rigor of ransomware recovery simulations.Invest in advanced threat detection for AI-driven attacks (e.g., deepfake identification tools).Promote cross-industry collaboration to address systemic vulnerabilities in supply chains..