It is 16:59 on Friday of a bank weekend. As you are packing up to leave, you get a call from Customer Operations stating that customers are calling the call centre to report an e-mail with attachment from the bank that is requesting login facts. Those who have opened the attachment are reporting unusual activity on their PC. While on that call, at 17:05, IT Operations make contact to say they are getting a flood of mail undeliverable messages which are blocking the internet gateways and e-mail, disrupting the online banking service. By 17:15, reports of unauthorised access login attempts to online banking are being called in. By 18:00 internal staff has reported opening the mail and have issues on their PCs. The network is slowing down. Queues are forming at ATMs and a reporter has called enquiring as to the reason for the queues. Using the event management steps, in your role as Incident Manager, describe the actions you would take to address this incident.

(a) Record actions as a log, [Date/time / decision / action/ made by / actioned by / additional notes]

(b) draft high level update communications and

(c) Write your incident report and recommendations.