Synthetic tenant: Kestrova Health (fictional), 442 receipts. Sixty days of activity are generated deterministically and anchored to the current hour, so expiry and breach clocks are live. Every receipt is signed at load with Ed25519 key ksv-47c7d4987f3a and re-verified by the same code the public verify API runs. Consents you sign in the patient journeys appear at the top of the registry, held only in your browser.
INC-2026-031: Phishing compromise of a billing account
Kestrova Kukatpally · became aware 31 Oct 2026, 5:30 am IST · about 230 people
A billing executive's email credentials were phished. The attacker had access to the insurance pre-auth queue for about 2 hours and may have viewed records of approximately 230 patients (names, policy numbers, diagnoses). Password reset and session revocation are done.
The four clocks
Report to CERT-In
CERT-In Directions, 28 Apr 2022: within 6 hours
2h 14m left
Initial intimation to the Board
DPDP Rule 7(2)(a): without delay. Internal target 24h
20h 14m left
Intimation to each affected patient
DPDP Rule 7(1): without delay. Internal target 48h
44h 14m left
Detailed report to the Board
DPDP Rule 7(2)(b): within 72 hours
68h 14m left
Rule-matrix triage
- Severity
- medium
- Board intimation
- Required (every breach)
- Patient intimation
- Required (every breach)
- CERT-In
- Likely reportable
Deterministic rule matrix. Exposure vector: unauthorised access or credential compromise (matched "phish", "credential"). Scale: 230 parsed from the text. Severity = vector 2 + scale 0 points = MEDIUM. Board and patient intimation are not scored: DPDP requires both for every personal data breach. Factor coverage 100% is how many of the three matrix inputs the text supplied, not a confidence score.
AI second opinion
Advisory only. A model reads the incident; its answer is validated, then set beside the matrix. The matrix decides severity and no model decides a legal duty.
Immediate actions
- highContain: isolate affected systems and revoke exposed credentials · CISO
- highReport to CERT-In within 6 hours of noticing the incident · CISO
- highIntimate the Data Protection Board without delay: nature, extent, timing, location, likely impact (Rule 7(2)(a)) · DPO
- highIntimate each affected patient without delay, in plain language and their language (Rule 7(1)) · DPO
- mediumFile the detailed report with the Board within 72 hours: causes, mitigation, remediation, patient intimations (Rule 7(2)(b)) · DPO
Drafts for DPO review
The hospital name, contact and triage come from the server. Drafts are never sent; filing and sending are out of scope here.
Initial intimation to the Board
Notice to affected patients