Third of three presentations given for a public relations course. Project addressed crisis situation for company. Crisis was assigned two days before the presentation was to be given.

1. +
Crisis Management Briefing
Dec. 10th, 2009 8:30 a.m.
Corsina Perez and Sarah Laupan

2. +
Situation Summary
Hackers got in to the official Amtrak
website and started stealing customers
credit card information. By the time it
was discovered that our website was
compromised (Dec. 10th, 6 a.m.), over
1,200 credit card numbers had been
compromised.

3. +
Background Information
Amtrak recently entered into a 5-year outsourcing
agreement with AT&T at the end of June 2009. Under
the agreement AT&T is our provider of
telecommunications networking services, including
our managed security services to help protect our
telecommunication network infrastructure, including
our website and the personal information of our
passengers.
AT&T Government Solutions Headquarters:
1900 Gallows Road
Vienna, VA 22182
703-506-5000

4. Thursday, Dec. 10th – Day 1
+ n 6 a.m. – AT&T securities notifies Amtrak top
mgmt of the breach, who then notifies the
PR teams. Announcement of meeting at
D.C. Union Station offices at 8:30 a.m. for
briefing.
n 7:30 a.m. – Contacted AT&T to learn current
status of situation. Learned that system is no
longer vulnerable.
Action Taken n 8 a.m. – Contacted FBI cyber crimes
division. Corp. Comm. team member Sarah
[up to Present Time] Laupan designated in charge of all
communication with FBI. Space will be
made for agents to work at our HQ and at
the AT&T offices.
n 8:30 a.m. – Current briefing on overview of
action plan.

5. Thursday, Dec. 10th – Day 1
+ n 9 a.m. – 2 Members of Corporate
Communications team will be sent to the
AT&T offices.
Set up of Information Call Center to
deal with customer inquiries at our HQ
offices at Union Station in D.C.
n 9:30 a.m. – Contact credit card
companies fraud departments to notify
Plan Overview them of the situation. Decide on plan of
action on their part in dealing with
accounts. We will get back to them as soon
All following plans are as we find out any information about the
considered tentative and are specific cardholders identities.
subject to change based on
actual occurrences. We will n 10 a.m. – Draft press release about the
respond accordingly to whatever incident. Two plans of action for distribution;
situation as it arises. All Immediately at the completion of
communication with staff for recovering identities of customers affected,
important updates will be issued if on the first day, or early morning of the
through company e-mail and second day.
company mobile phone Corp. Comm. will send out e-mail to
communication, accordingly. all corporate employees to inform of
situation.

6. Thursday, Dec. 10th – Day 1
+ n 11 a.m. – Draft statement to be posted on
company website acknowledging security
breach.
n Late Morning-Early Afternoon – Continue
constant communication with AT&T office,
FBI investigation, and our HQ.
n Late Afternoon-Early Evening – By AT&T s
Plan Overview estimate, we expect to have the identified
all customers affected by the security
breach by late afternoon to early evening.
All following plans are All further official plans are based on this
considered tentative and are estimate.
subject to change based on -Contact credit companies and
actual occurrences. We will confirm cancellation and re-issue of
respond accordingly to whatever affected account numbers.
situation as it arises. All -Distribute press release and post
communication with staff for website statement.
important updates will be issued -Announce press conference to be
through company e-mail and held at Union Station offices at 11 a.m.
company mobile phone Friday.
communication, accordingly. -Launch Info Call Center. Open till 10
p.m. ET.

7. Friday, Dec. 11th – Day 2
+ n All Day – Information Call Center is open
and running; 9 a.m.-10 p.m. ET.
Continue constant communication
with AT&T. Amtrak team member will be at
AT&T s offices for the day.
Following up with FBI Investigation as
needed.
n Morning – Write and start process of sending
Plan Overview out letter of apology to be sent out to each
customer affected.
All following plans are n 11 a.m. – Press Conference at Union Station
considered tentative and are HQ in D.C. given by appointed
subject to change based on spokesperson, Corsina. Press kits will be
actual occurrences. We will distributed to media channels present.
respond accordingly to whatever Conference will give follow-up details on
situation as it arises. All press release and will take questions.
communication with staff for
important updates will be issued n Afternoon – Dedicated to providing
through company e-mail and interviews and information to media
company mobile phone channels seeking them, headed by official
communication, accordingly. spokesperson.

8. Saturday, Dec. 12th – Day 3
+ n All Day – Info Call Center will be open from
9 a.m.-10 p.m. ET.
Amtrak team member will wrap up
duties at AT&T offices and gather all data
collected by AT&T during the investigation.
AT&T will be instructed to share any further
data with us, as well as the FBI.
Continue to assist in FBI investigation
as needed.
Plan Overview n 9 a.m. – Follow-up briefing with internal staff
to go over what the details of the incident
All following plans are were and any actions to be followed up on.
considered tentative and are Send out follow-up e-mail to corporate
subject to change based on employees and management
actual occurrences. We will
respond accordingly to whatever n Day 3 Afternoon – Top Amtrak
situation as it arises. All management will meet with AT&T
communication with staff for management to seek answers as to cause
important updates will be issued and solutions of problem. If AT&T is unable
through company e-mail and to give us sufficient solutions we may be
company mobile phone seeking to end our agreement/contract
communication, accordingly. with them and seeking outsourcing our
securities elsewhere.

9. Sunday, Dec. 13th – Day 4
+ n All Day – Info Call Center will be open from
9 a.m.-10 p.m. ET. Reduction in staff in the
Info Call Center by 7 people.
Check in with FBI team in morning
and continue to assist in investigation as
needed.
Plan Overview
All following plans are
considered tentative and are
subject to change based on
actual occurrences. We will
respond accordingly to whatever
situation as it arises. All
communication with staff for
important updates will be issued
through company e-mail and
company mobile phone
communication, accordingly.

10. Monday, Dec. 14th – Day 5
+ n All Day – Info Call Center will be open from
9 a.m.-7 p.m. ET. Reduce staff in Info Call
Center to 23 people. Update website
statement with new Info Call Center hours.
Update with FBI concerning the
investigation. Goal to wrap-up investigation
by Day 7, including having answers as to
who is behind the crime. Contact legal
department regarding seeking to press
Plan Overview charges against the guilty individual(s).
n 10 a.m. – Issue updated Press Release with
All following plans are any new information as to how the security
considered tentative and are breach happened and any new
subject to change based on developments in updating our security
actual occurrences. We will protocols and settling on a resolution
respond accordingly to whatever between Amtrak and AT&T.
situation as it arises. All
communication with staff for n Afternoon – Available for interviews based
important updates will be issued on updated press release. Interviews done
through company e-mail and by spokesperson, Corsina.
company mobile phone
communication, accordingly.

11. Tuesday, Dec. 15th – Day 6
+ n All Day – Info Call Center will be open from
9 a.m.-7 p.m. ET. Reduce staff in Info Call
Center by to 17 people. Prepare regular
Customer Service Call Center to receive
calls from Info Call Center lines starting the
next day. Prepare to have calls transferred
from Info 1-800 number to Customer Service
lines and prepare staff by providing briefing
on the status of situation.
Plan Overview Continue to wrap up details of
investigation with FBI and proceed with
process in assisting legal department to
All following plans are seek pressing charges.
considered tentative and are
subject to change based on
actual occurrences. We will
respond accordingly to whatever
situation as it arises. All
communication with staff for
important updates will be issued
through company e-mail and
company mobile phone
communication, accordingly.

12. Wednesday, Dec. 16th – Day 7
+ n All Day – Wrap up final details of FBI s
findings from their investigation. Move
forward with pressing charges against the
accused at fault. We do not plan on
releasing any details as to the identity of the
individual(s) accused until formal criminal
charges have been filed.
All calls coming into the Info Call
Center number will be programmed to
Plan Overview transfer to the Customer Service Call
Center. Update website statement to
remove Info Call Center 1-800 number and
All following plans are to refer all customer inquiries to the
considered tentative and are Customer Service Call Center number.
subject to change based on
actual occurrences. We will
respond accordingly to whatever
situation as it arises. All
communication with staff for
important updates will be issued
through company e-mail and
company mobile phone
communication, accordingly.

13. +
Questions or
Comments?