Target
2013–14
40M
payment cards stolen
What happened
Hackers stole card data for 40M accounts and personal details for up to 70M customers just before Christmas. Q4 profit fell 46%.
What the board did
The board met monthly instead of quarterly. CIO Beth Jacob resigned, then CEO Gregg Steinhafel stepped down about five months after disclosure.
Inside the boardroom: timeline
-
19 Dec 2013Breach disclosed. The board then meets the CEO monthly instead of quarterly.
-
Mar 2014CIO Beth Jacob resigns.
-
5 May 2014CEO Steinhafel steps down. CFO John Mulligan becomes interim CEO; director Roxanne Austin interim non-executive chair; Korn Ferry hired for the search.
-
28 May 2014Proxy adviser ISS urges investors to vote out 7 of 10 directors on the audit and corporate responsibility committees.
-
11 Jun 2014All 10 directors are re-elected with ~75% average support; Glass Lewis had disagreed with ISS.
Lesson
One of the first big-company CEOs to fall over a breach: cyber is now a CEO and board risk.
Equifax
2017
143M
Americans’ data exposed
What happened
Attackers exploited an Apache Struts flaw that had a patch available. Executives sold shares before disclosure.
What the board did
The CIO and CSO retired, then CEO Richard Smith retired. A board member became non-executive chair and an interim CEO was named.
Inside the boardroom: timeline
-
29 Jul 2017Security staff spot suspicious activity; executives sell shares days later.
-
7 Sep 2017Breach disclosed. The board forms a special committee of independent directors, advised by WilmerHale.
-
15 Sep 2017CIO and CSO retire.
-
26 Sep 2017CEO Richard Smith retires; director Mark Feidler becomes non-executive chair and an interim CEO is named.
-
1–3 Nov 2017After 62 interviews and 55,000+ documents, the committee clears the four executives of insider trading.
Lesson
Patching discipline and a rehearsed breach response are governance issues.
Maersk
2017
$300M
estimated cost of NotPetya
What happened
NotPetya malware wiped Maersk’s global network. One domain controller in Ghana survived because a power cut had taken it offline.
What the board did
The company rebuilt about 4,000 servers and 45,000 PCs in roughly ten days and openly shared its lessons.
Inside the boardroom: timeline
-
27 Jun 2017NotPetya hits; staff move to manual processes and keep ~80% of volumes moving.
-
~10 days laterIT rebuilt: 4,000 servers, 45,000 PCs, 2,500 apps.
-
Aug 2017Company puts the cost at $200–300M in its results.
-
Jan 2018Chairman Jim Hagemann Snabe tells Davos Maersk was ‘basically average’ on cyber and vows to make security a competitive advantage.
Few internal board minutes are public; this follows the chairman’s own account.
Lesson
Resilience, offline backups and segmentation decide how long you stay down.
UnitedHealth · Change
2024
$22M
ransom paid in Bitcoin
What happened
BlackCat hackers entered Change Healthcare through a server with no multi-factor authentication. US claims and payments stalled for weeks.
What the board did
CEO Andrew Witty personally approved the ransom and testified to the Senate and House. The company advanced $6.5B to affected providers.
Inside the boardroom: timeline
-
12 Feb 2024Hackers enter through a Change Healthcare portal without MFA.
-
21 Feb 2024Ransomware deployed; Change is disconnected and the FBI is called.
-
After the attackCEO Andrew Witty personally decides to pay a $22M ransom in Bitcoin.
-
Apr 2024Q1 results show nearly $900M in costs; $6.5B advanced to providers.
-
1 May 2024Witty testifies to Senate and House committees and apologises.
Public record centres on the CEO; board-level deliberations weren’t disclosed.
Lesson
Acquired companies’ legacy IT is the board’s risk too, and ransom decisions need a plan.
Marks & Spencer
2025
46 days
online orders halted
What happened
Hackers (linked to Scattered Spider) tricked staff at a third-party contractor to break in. Contactless payments and stock systems were hit too.
What the board did
Leadership forecast about a £300M operating-profit hit, aimed to halve it through insurance and cost control, and sped up tech upgrades.
Inside the boardroom: timeline
-
Before 2025Cyber is top of the board risk register; Audit & Risk Committee had tripled cyber staff and doubled spend.
-
17–19 Apr 2025Hackers get in via ‘sophisticated impersonation’ of a third party; detected two days later; authorities told.
-
22–25 Apr 2025Customers told; online orders paused. Leadership decides no one will deal directly with the attackers.
-
10 Jun 2025Online orders resume after 46 days.
-
8 Jul 2025Chairman Archie Norman tells MPs the board won’t say if a ransom was paid; insurance claim could take 18 months.
Lesson
Social engineering of suppliers is a top risk; third-party access needs board attention.
Jaguar Land Rover
2025
£1.5bn
UK government loan guarantee
What happened
A cyberattack on 31 August shut JLR’s factories in the UK and abroad for about a month, leaving suppliers near collapse.
What the board did
JLR secured a five-year £1.5bn bank loan backed by the UK government, believed to be the first state support of its kind after a cyberattack.
Inside the boardroom: timeline
-
31 Aug 2025Cyberattack; JLR shuts systems and halts production worldwide.
-
2 Sep 2025Attack disclosed; ministers in daily contact.
-
Sep 2025Pause extended to at least 1 October as suppliers struggle.
-
28 Sep 2025UK government backs a £1.5bn five-year bank loan.
-
6–8 Oct 2025Phased restart begins; new financing scheme pays suppliers early.
Board deliberations weren’t made public; JLR is owned by Tata Motors.
Lesson
A cyberattack can become a national economic and supply-chain crisis.