+

Crisis Management Briefing Dec. 10th, 2009 8:30 a.m.

Corsina Perez and Sarah Laupan

+Situation Summary

Hackers got in to the official Amtrak website and started stealing customers’ credit card information. By the time it was discovered that our website was compromised (Dec. 10th, 6 a.m.), over 1,200 credit card numbers had been compromised.

+Background Information Amtrak recently entered into a 5-year outsourcing

agreement with AT&T at the end of June 2009. Under the agreement AT&T is our provider of telecommunications networking services, including our managed security services to help protect our telecommunication network infrastructure, including our website and the personal information of our passengers.

AT&T Government Solutions Headquarters:

1900 Gallows Road Vienna, VA 22182 703-506-5000

+

Action Taken [up to Present Time]

Thursday, Dec. 10th – Day 1 n  6 a.m. – AT&T securities notifies Amtrak top

mgmt of the breach, who then notifies the PR teams. Announcement of meeting at D.C. Union Station offices at 8:30 a.m. for briefing.

n  7:30 a.m. – Contacted AT&T to learn current status of situation. Learned that system is no longer vulnerable.

n  8 a.m. – Contacted FBI cyber crimes division. Corp. Comm. team member Sarah Laupan designated in charge of all communication with FBI. Space will be made for agents to work at our HQ and at the AT&T offices.

n  8:30 a.m. – Current briefing on overview of action plan.

+

Plan Overview

Thursday, Dec. 10th – Day 1 n  9 a.m. – 2 Members of Corporate

Communications team will be sent to the AT&T offices.

Set up of Information Call Center to deal with customer inquiries at our HQ offices at Union Station in D.C.

n  9:30 a.m. – Contact credit card companies’ fraud departments to notify them of the situation. Decide on plan of action on their part in dealing with accounts. We will get back to them as soon as we find out any information about the specific cardholders’ identities.

n  10 a.m. – Draft press release about the incident. Two plans of action for distribution; Immediately at the completion of recovering identities of customers affected, if on the first day, or early morning of the second day.

Corp. Comm. will send out e-mail to all corporate employees to inform of situation.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Thursday, Dec. 10th – Day 1 n  11 a.m. – Draft statement to be posted on

company website acknowledging security breach.

n  Late Morning-Early Afternoon – Continue constant communication with AT&T office, FBI investigation, and our HQ.

n  Late Afternoon-Early Evening – By AT&T’s estimate, we expect to have the identified all customers affected by the security breach by late afternoon to early evening. All further official plans are based on this estimate.

-Contact credit companies and confirm cancellation and re-issue of affected account numbers.

-Distribute press release and post website statement.

-Announce press conference to be held at Union Station offices at 11 a.m. Friday.

-Launch Info Call Center. Open till 10 p.m. ET.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Friday, Dec. 11th – Day 2 n  All Day – Information Call Center is open

and running; 9 a.m.-10 p.m. ET. Continue constant communication

with AT&T. Amtrak team member will be at AT&T’s offices for the day.

Following up with FBI Investigation as needed.

n  Morning – Write and start process of sending out letter of apology to be sent out to each customer affected.

n  11 a.m. – Press Conference at Union Station HQ in D.C. given by appointed spokesperson, Corsina. Press kits will be distributed to media channels present. Conference will give follow-up details on press release and will take questions.

n  Afternoon – Dedicated to providing interviews and information to media channels seeking them, headed by official spokesperson.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Saturday, Dec. 12th – Day 3 n  All Day – Info Call Center will be open from

9 a.m.-10 p.m. ET. Amtrak team member will wrap up

duties at AT&T offices and gather all data collected by AT&T during the investigation. AT&T will be instructed to share any further data with us, as well as the FBI.

Continue to assist in FBI investigation as needed.

n  9 a.m. – Follow-up briefing with internal staff to go over what the details of the incident were and any actions to be followed up on. Send out follow-up e-mail to corporate employees and management

n  Day 3 Afternoon – Top Amtrak management will meet with AT&T management to seek answers as to cause and solutions of problem. If AT&T is unable to give us sufficient solutions we may be seeking to end our agreement/contract with them and seeking outsourcing our securities elsewhere.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Sunday, Dec. 13th – Day 4 n  All Day – Info Call Center will be open from

9 a.m.-10 p.m. ET. Reduction in staff in the Info Call Center by 7 people.

Check in with FBI team in morning and continue to assist in investigation as needed.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Monday, Dec. 14th – Day 5 n  All Day – Info Call Center will be open from

9 a.m.-7 p.m. ET. Reduce staff in Info Call Center to 23 people. Update website statement with new Info Call Center hours.

Update with FBI concerning the investigation. Goal to wrap-up investigation by Day 7, including having answers as to who is behind the crime. Contact legal department regarding seeking to press charges against the guilty individual(s).

n  10 a.m. – Issue updated Press Release with any new information as to how the security breach happened and any new developments in updating our security protocols and settling on a resolution between Amtrak and AT&T.

n  Afternoon – Available for interviews based on updated press release. Interviews done by spokesperson, Corsina.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Tuesday, Dec. 15th – Day 6 n  All Day – Info Call Center will be open from

9 a.m.-7 p.m. ET. Reduce staff in Info Call Center by to 17 people. Prepare regular Customer Service Call Center to receive calls from Info Call Center lines starting the next day. Prepare to have calls transferred from Info 1-800 number to Customer Service lines and prepare staff by providing briefing on the status of situation.

Continue to wrap up details of investigation with FBI and proceed with process in assisting legal department to seek pressing charges. All following plans are

considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Plan Overview

Wednesday, Dec. 16th – Day 7 n  All Day – Wrap up final details of FBI’s

findings from their investigation. Move forward with pressing charges against the accused at fault. We do not plan on releasing any details as to the identity of the individual(s) accused until formal criminal charges have been filed.

All calls coming into the Info Call Center number will be programmed to transfer to the Customer Service Call Center. Update website statement to remove Info Call Center 1-800 number and to refer all customer inquiries to the Customer Service Call Center number.

All following plans are considered tentative and are subject to change based on actual occurrences. We will respond accordingly to whatever situation as it arises. All communication with staff for important updates will be issued through company e-mail and company mobile phone communication, accordingly.

+

Questions or Comments?