You are Gabriela Mejía, general manager of Financiera del Norte, a microfinance lender in San Pedro Sula, Honduras. At six this evening a ransomware attack encrypted every system you have. Tonight you must decide how wide to open the circle: whom you bring into the response before you know what happened.
The situation
Tuesday 9 June 2026. Every screen shows the same message in English: the files are encrypted and the key costs US$450,000 in bitcoin, payable within 72 hours. Twenty minutes later your chief technology officer, Josué Aguilar, confirms that the lending system is down and that a sample of 200 client files, with names, ID numbers, addresses and loan amounts, is already published on the dark web.
Financiera del Norte lends to small businesses and families in northern Honduras: 35,000 clients, a US$180 million loan book and US$5 million of cash reserves. The last full backup is eleven days old; last night's is corrupt. In those eleven days about US$3 million went out in loans, about US$4 million came in as repayments and some US$200,000 in fees. While the systems are down, the branches can neither lend nor record payments.
As a regulated lender, the firm must notify the Banco Central de Honduras within 48 hours of confirming the incident, with possible fines of US$150,000 to 600,000. Paying a criminal group could also open a money-laundering investigation. And a cybersecurity project of about US$500,000 has been waiting two years for the board's approval.
Your team pulls in different directions. Your general counsel, Karen Pineda, reminds you that the authorities advise against paying ransoms. Your finance manager, Raúl Banegas, wants to know how much of the reserve this will eat. Your head of communications, Ana Lucía Rivera, warns that clients will hear it from the media if the firm does not speak first. Aguilar waits at the door for your go-ahead to call a forensic firm.