A large organization experienced an attack by an advanced persistent threat actor. Responding to an incident requires careful orchestration. The IR team removed the attackers from the network within 36 hours. The expulsion event eradicated the attackers tools, cut off their ability to reenter the network. To offset the negative news, the company directly notified customers, employees and law enforcement organizations about the breach and the status of remediative actions that were underway. Developed a communication strategy. Hired outside crisis communications agencies to craft messaging to defuse speculation.”]
Source: https://www.darkreading.com/attacks-breaches/you-ve-been-attacked-now-what-