Attendee List Leaked Online

An attendee posts a screenshot showing the full delegate list — including private emails and dietary requirements — is publicly accessible via your registration platform.

Setting: Healthcare conference, 2,000 delegates, GDPR jurisdiction. Category: Crisis Communications. Pressure level: High.

This page is the individual, citable address for this one situation: https://gatheringarchitecture.com/crisis-sim/scenario/data-breach

The situation

Your phone lights up with mentions. The screenshot shows names, emails, and notes like 'severe nut allergy' and 'recovering from surgery.' The post has 400 retweets and climbing. Press DMs are arriving.

First moves and what each one costs

• Take the registration system offline immediately, engage legal, draft a notification email to all delegates within the hour — Containment within 45 minutes. You meet your regulatory window. Delegates appreciate the speed.
• Investigate quietly to confirm the leak before saying anything — By the time you confirm, the story has been picked up by trade press. You look reactive instead of proactive.
• Publicly state the screenshot is fake or out of context — It's verified within an hour. Your credibility is destroyed. Regulators open a formal investigation.

Preparation notes for this situation

• Audit registration platform privacy settings BEFORE go-live, not after
• Have a written incident response plan with legal counsel on speed-dial
• Meet regulatory timeframes: under GDPR, notify the data-protection authority within 72 hours, and affected people without undue delay when the risk to them is high

Open the Game Plan · Run the Simulation · See all 35 scenarios