## 1. Internal Employee Update **Subject:** Security Incident Update: What We Know and What You Need to Do **To:** All Employees Team, We want you to hear this from us first. Nexus Cloud Logistics has identified a security incident involving a third-party vendor, which led to potential unauthorized access to one of our secondary staging servers. **What we know** - The affected server held historic routing manifest data from Q2 2025. - Based on our current findings, core client financial data was not affected and remains secure. - Operations are running normally. No systems that support day-to-day work have been disrupted. **What we have done** - Isolated the affected server. - Revoked the third-party vendor's API access. - Engaged our cybersecurity forensics team. - Notified law enforcement. **What we need from you** 1. **Do not discuss this incident** on social media, with the press, or with anyone outside the company. Forward any media inquiries to [Communications Lead / Name]. 2. **Direct client questions** to [Account Management escalation contact]. Do not speculate on scope or cause. Use only the approved client messaging we will provide. 3. **Report anything unusual**, such as suspicious emails, login prompts, or system behavior, to the IT Security Hotline right away. 4. **Be alert to phishing.** Incidents like this can prompt follow-on attempts. Do not click unexpected links or share credentials. 5. Continue your normal work. No changes to your duties are required at this time. **Questions and next update** Contact the IT Security Hotline at **ext. 4455** or **legal@nexuscloud.com**. We will send our next update by **[date/time, e.g., within 24 hours]**, or sooner if there are material developments. Thank you for your professionalism and discretion. [Name] [Title], Nexus Cloud Logistics --- ## 2. Client Reassurance Email **Subject:** Security Notice from Nexus Cloud Logistics: Your Financial Data Remains Secure **To:** B2B Clients / Partners Dear [Client Name], We are writing to inform you of a security incident and to share what we know so far. **What happened** A compromise at a third-party vendor led to potential unauthorized access to a secondary staging server at Nexus Cloud Logistics. **What was and was not affected** - Based on our investigation to date, **core client financial data is secure** and was not part of this incident. - The potentially exposed data is limited to **historic routing manifest data from Q2 2025**. [Legal to confirm exact data fields and whether any client-identifying details are included.] - **Our services are operating normally.** Your shipments, platform access, and day-to-day operations are unaffected. **Actions we have taken** - Isolated the affected server immediately. - Revoked the vendor's API access. - Deployed our cybersecurity forensics team to investigate. - Notified law enforcement. **What you can do** No action is required on your part at this time. As a precaution, we encourage you to stay alert to unexpected requests for information or credentials that reference this incident. If your team has questions about whether your organization's data was included, we will assist directly. **Contact and next update** Please reach out to [Account Manager / Client Security Liaison] or email **legal@nexuscloud.com**. We will provide a further update by **[date/time]** as our investigation progresses, and we will notify you promptly of any material change in scope. We take the trust you place in us seriously, and we are committed to being transparent as we learn more. Sincerely, [Name] [Title], Nexus Cloud Logistics --- ## 3. Public Holding Statement **Headline:** Nexus Cloud Logistics Responds to Third-Party Vendor Security Incident; Operations Unaffected **For Immediate Release** **[City, Date]** Nexus Cloud Logistics today confirmed that it identified a security incident originating from a compromise at a third-party vendor, which may have resulted in unauthorized access to a secondary staging server. Our investigation to date indicates that the potentially exposed data is limited to historic routing manifest data from the second quarter of 2025. Core client financial data was not affected. Company operations and services continue without disruption. Upon identifying the incident, Nexus Cloud Logistics isolated the affected server, revoked the vendor's access, engaged a cybersecurity forensics team, and notified law enforcement. We are cooperating fully with authorities. [Legal to confirm regulatory notification status and obligations.] "[Executive quote: e.g., We take the security of our systems and the trust of our clients seriously. We acted quickly to contain this incident and are committed to transparency as our investigation continues. — Name, Title]" The investigation is ongoing, and we will share verified updates as they become available. We will provide our next update by **[date/time]**. **Media contact:** [Name], [email/phone] **Security inquiries:** IT Security Hotline, ext. 4455, or legal@nexuscloud.com --- **Before sending:** Legal should review the data scope language ("historic routing manifest data") and the "financial data is secure" claim, which is worded as "based on current findings" so it stays accurate if the forensics results change. They should also confirm any breach-notification deadlines that may apply.