Cyber Attack Crisis Management Report: Cadbury Company Analysis

This report analyzes a cyber attack on the Cadbury Company in Australia, focusing on the WannaCry ransomware incident that disrupted its IT systems and production. The report details the issue and crisis management plans implemented, including monitoring, identification, prioritization, analysis, strategy decisions, implementation, and evaluation. It outlines the crisis communication strategies used to inform stakeholders and mitigate reputational damage. The report also examines the company's response, including acknowledging the issue, categorizing the crisis, defining roles and responsibilities, and utilizing various communication channels. Furthermore, the report assesses the effectiveness of Cadbury's crisis management strategies, highlighting the importance of proactive measures and transparent communication in regaining public trust and minimizing the impact of cyberattacks.

Running head: CYBER ATTACK
Cyber Attack
Name of the student:
Name of the university:
Author note

1CYBER ATTACK
Table of Contents
1.0 Introduction................................................................................................................................3
1.1 The Issue....................................................................................................................................3
1.2Methods......................................................................................................................................5
1.2.1 Issue Management Plan......................................................................................................5
1.2.11 Monitoring....................................................................................................................5
1.2.12 Identification.................................................................................................................5
1.2.13 Prioritization.................................................................................................................5
1.2.14 Analysis........................................................................................................................6
1.2.16 Strategy Decision..........................................................................................................7
1.2.17 Implementation.............................................................................................................7
1.2.18 Evaluation.....................................................................................................................7
1.3 Crisis Management Plan........................................................................................................7
1.3.11 About the crisis.................................................................................................................7
1.3.12 Categorization of crisis.....................................................................................................7
1.3.13 Roles and responsibilities.............................................................................................8
1.3.14 Contact list....................................................................................................................8
1.3.15 Pre- approved information............................................................................................8
1.3.16 Checklist.......................................................................................................................8
1.3.17 Training.........................................................................................................................8

2CYBER ATTACK
1.4 Crisis communication............................................................................................................9
2.0 Crisis Management Strategies...................................................................................................9
3.0 Conclusion...............................................................................................................................10
Reference.......................................................................................................................................11

3CYBER ATTACK
1.0 Introduction
Issue can arrive at any point of time which can lead to crisis if not managed properly. The
process used for identifying and solving the issues is known as issue management. Issues can be
categorized as problems in the organization with the staff or suppliers, any kind of technical
failure or material shortage or unavailability of resources. All these issues will have a negative
impact on the organization so they need to be mitigated soon for better organizational
performance. In the same way, crisis is also a threat to the organization which needs to be
resolved by crisis management plan(Alexander 2014). Thus, a total corporate response can be
built up with the identification of the crisis. A crisis not only damages the organization but also
its stakeholders and general public. Crisis management became popular in the 1980s when
industries and environment had to come across ample amount of disasters. Crisis in an
organization can question the public safety, lead to economic loss and also hamper reputation.
For managing crisis it is important to identify the issue at first which will help in the smooth
management of the situation.
For this particular assignment, the issue of cyber attack on the Cadbury Company of
Australia will be taken into consideration. The details of the crisis will be elaborate along with
the steps taken to reduce the crisis.
1.1 The Issue
To resolve the crisis the project manager prepares a crisis management plan from bringing
visibility to the issue and accountability as to how it can be resolved (Argenti 2015). A crisis
management plan is composed of various steps which need to be followed accordingly.

4CYBER ATTACK
In the case of Cadbury Company the issue identified was the ransomeware attack.
WannaCryransomeware attack that had spread across the world in May 2017 was targeted
towards the computers which ran under Microsoft Windows Operating System. It had affected
the online service by encrypting data and demanding ransom payments. It was reported to affect
more than 230,000 computers in over 150 countries in a single day(Black 2013).
The Cadbury factory in Australia was also targeted by the ransomeware attack which had
affected the IT system of the company. The production of the company came to a halt when the
computer system started de- functioning. Experts had described it as cyber attack. Actually it was
a worldwide malware attack which took a toll on the biggest oil companies, banks and shutting
down the computer operations at the multinational companies, shipping and advertising agencies.
The company chosen for this assignment was ordered to pay the ransom in Bitcoin currency. The
message on the computer screen showed that the files on the computer are not accessible as they
were encrypted. It was clearly stated that Cadbury should not waste time by trying to recover the
files. Instead the company should send $300 in the value of Bitcoin to the mentioned address.
This was a terrible threat to the company’s reputation and they have not given a thought to the
security and safety of their computers until that day. The online system of the Cadbury was
regarded as the most advanced and highly automated as most of their services were carried out
through the computer operations. They also had the most updated virus protection security. Even
with the most advanced and upgraded computer system, the company had to face such a disaster.
They were among those companies who took the online activities seriously(Booth 2015). This is
because they believed that with lack of attention in the performance of computer system the
workers get affected the most. But the crisis of ransomeware had left them in trouble as to when
will the problem be resolved.

5CYBER ATTACK
1.2Methods
1.2.1 Issue Management Plan
1.2.11 Monitoring
The solution of the problem is not yet decided, as it was reported by the company. They were
working with their utmost effort offline to address the global concern. With the resolution of this
crisis the Cadbury Company will be able to continue their business in the previous way to meet
up to the expectations of the customers and consumes all over the world.
1.2.12 Identification
The issue was identified when the operation came to a halt all of a sudden and the company
had no idea about the cause. They were also ready to share their recent updates about the solution
with the suppliers and other available stakeholders.But they cannot assure when the online
systems will be ready for operating and therefore they expect everyone’s patience, cooperation
and understanding. The severity of the attack began with a tiny code in the Word and PDF
document and resulted in the shutdown of the global online system. So it was not easy to find an
immediate solution to such a huge problem.
1.2.13 Prioritization
The hacking tool used in WannaCryransomeware was similar to the Petyaransomeware
which was resolved by a British researcher by a kill- switch and that included a code, ‘eternal
blue’. The injuries done by the ransomeware attack takes time to completely heal (Coombs
2014). It is said that every company is attacked by ransomware each 40 seconds. WannaCry was
regarded as the biggest cyber attack in the history of internet ever.

6CYBER ATTACK
1.2.14 Analysis
It is not an easy task to find instant solution to these cyber attacks but as a cyber security
lecturer mentioned that there are businesses which are able to protect themselves from cyber
attacks. It is not impossible to bring down the risk to zero level. The probable solution for these
kinds of attacks was to make sure that the IT systems were properly patched. This is because it
was observed after the attack that there are many companies with similar systems but only with
the older unpatched IT systems was targeted (Coombs et al. 2016).
Strength- The strong network of an expert team and
early identification
Weakness- Hamper in the production of the
company with loss in sales
Opportunities- Ready solution saved the company
from major loss and effective media plan helped in
better communication
Threat- Other companies gained profit due to the
attack on Cadbury company
1.2.15 Mendelow’s matrix
High interest The employees and suppliers
were not allowed to suffer due to
this crisis. Mainstream media
was immediately informed
Executive, software developers
carried out their duty
accordingly. The public demands
were met along with abidance b
the government norms
Low interest People were not faced with a
direct impact as the attack was
mainly on the industry
The main professional and the
online industry bloggers were
given relevant information
Low influence High influence

7CYBER ATTACK
1.2.16 Strategy Decision
The strategic response involved the immediate dissemination of information to the public
through various channels of media. The spokesperson of the company reached out to the target
group by using broadcasting, print and online media.
1.2.17 Implementation
The strategies were implemented appropriately to make sure that the company reputation
is not hampered in any way and their future sales are not to be affected.
1.2.18 Evaluation
The issue was evaluated to find out that it had affected a lot of companies and a little bit
of precaution could have saved Cadbury from getting affected (Smith 2013).
1.3 Crisis Management Plan
1.3.11 About the crisis
The Cadbury Company was particular in this aspect of acknowledging the issue that they had
to face due to an unexpected attack. They did not hide the fact that their unpatched IT systems
were responsible that they could not prevent this accident.
1.3.12 Categorization of crisis
Although the attack of ransomware is few months old but its effects are still not negligible. A
kill switch that was invented for this cyber attack made it possible to prevent further spread of
the threat.

8CYBER ATTACK
1.3.13 Roles and responsibilities
Experts on computers and other security all over the globe have tried to find out the factors
responsible for this disastrous crisis. It was earlier suspected that North Korea was behind this
attack but nothing could be assured. The encrypted code of WannaCry was found similar to
another hacking group known as Lazarus. It was a matter of worry that whether the motive
behind this attack was only financial gain or something more destructive as only a small sum was
demanded (Dozier, Grunig and Grunig 2013).
1.3.14 Contact list
The board of members, employees, customers, other upcoming and potential customers,
government authorities and media are the main stakeholders of the company.
1.3.15 Pre- approved information
The Cadbury Company became the first among other Australian businesses to get affected by
the cyber attack. The reason behind this can be an old unpatched IT system of their operational
activities. The factors that added to the intensity of the attack included the maximum amount of
work that is done in the company with the help of internet. Their complete dependence on the
computer and internet made them suffer a lot as a result of this damage. The company which
produces around 50000 tons of chocolates every year had to face a major loss in sales because of
this sudden attack (Drennan, McConnell and Stark 2014).
1.3.16 Checklist
The crisis checklist and the stakeholder communication checklist were updated.
1.3.17 Training
Proper training was given to the spokesperson and the internal publics were also trained.

9CYBER ATTACK
1.4 Crisis communication
The crisis of the company as a result of the cyber attack was informed to the internal and
external publics attached to the company. Even the interviews by the spokesperson of the let the
world know about the crisis that they were facing. It was also mentioned that the problem has
been looked after and it will be resolved soon. Press releases were sent to the media and also on
the company websites and social media pages. It is not enough to communicate the crisis but
people would like to see the actions that are being taken in order to compensate the
crisis(Genserik and Thierry 2016).
2.0 Crisis Management Strategies
But the company which is selected in this scenario did not follow any unethical means to
manage their crisis. They had simply accepted the crisis that had occurred due to the ransomware
attack(Jin, Liu and Austin 2014). The company had tried to manage the crisis in the early stage
so that the internal and external publics are not offended. They made accurate fact checking so
that their message is clear and not misinterpreted. The company had chosen the spokesperson to
be their CEO who will be accepted by the stakeholders and other people. The publics were also
informed that their life will not be affected anyhow by this sudden attack and their services will
not be affected in any way(Williams et al. 2017). The success laid on the selection of their
communication tools because they had used all the channels to reach out to the public. The CEO
had clearly stated the amount of effect that has been imposed on the company and the steps that
they have undertaken to come out from the threat. He appreciated the effort of the stakeholders
who were working to manage the crisis situation. This statement was gladly accepted by the
people and kept them pacified in such a heated situation. The people were provided with clear

10CYBER ATTACK
data and calculation about the clear strategies that were being implemented by them (Ulmer,
Sellnow and Seeger 2013).
3.0 Conclusion
With effective crisis management by the company, they were able to regain their position
in the market. Unlike many other companies, they have accepted their crisis that evolved due to
ransomware attack and stopped the production of the company. This has resulted in a complete
evaluation and scrutiny of the company. Computer experts were called who had put their utmost
effort to manage the crisis. Although the production was hampered temporarily but gradually
they have recovered. The crisis had dropped the retailer stocking and also de- motivated the
employees. The morale of the employees got low which affected the reputation of the company.
It became a challenge for the company to bring back the lost confidence of its stakeholders. A
strong and focused communication program by the company had been successful in gaining the
credibility and reliability. The sales volume had increased ultimately and came closer to the pre-
crisis levels. It not only helped in regaining the morale of the stakeholders but also attained
customer satisfaction. This striking example of the company sets a recognition in the field of
crisis management.

11CYBER ATTACK
Reference
Alexander, D.E., 2014. Social media in disaster risk reduction and crisis management. Science
and Engineering Ethics, 20(3), pp.717-733.
Argenti, P.A., 2015. Corporate communication. McGraw-Hill Higher Education.
Black, S., 2013. Practice of public relations. Routledge.
Booth, S.A., 2015. Crisis management strategy: Competition and change in modern enterprises.
Routledge.
Coombs, W.T., 2014. Ongoing crisis communication: Planning, managing, and responding.
Sage Publications.
Coombs, W.T., Coombs, W.T., Holladay, S.J., Holladay, S.J., Claeys, A.S. and Claeys, A.S.,
2016. Debunking the myth of denial’s effectiveness in crisis communication: context
matters. Journal of Communication Management, 20(4), pp.381-395.
Dozier, D.M., Grunig, L.A. and Grunig, J.E., 2013. Manager's guide to excellence in public
relations and communication management. Routledge.
Drennan, L.T., McConnell, A. and Stark, A., 2014. Risk and crisis management in the public
sector. Routledge.
Drennan, L.T., McConnell, A. and Stark, A., 2014. Risk and crisis management in the public
sector. Routledge.
Genserik, R. and Thierry, M., 2016. 8 Crisis management.