Refresh outage on our platform today

Dear Declan, I would rather you heard this from me than from anyone else. Our platform had a refresh outage today, and I wanted you to have it in writing the same day, before you had to ask. What I can say now is limited. The nightly refresh did not complete as it should, our engineers are working on it, and I am not going to give you a cause until it is confirmed. I do not want to put a guess in front of your security team. I will send you a written post-incident review once engineering has agreed the timeline for producing it, and I will tell you that date as soon as I have it. I will not quote one before then. I have copied Theo, who will log this against the open findings in your review and tell you what evidence we can attach. If your team needs the information in a particular form, tell me and let me confirm that in writing. Best regards, Matteo

Matteo, Thank you for your note of 23 Jul 2026. I record that we were told on the same day, and that the notice came from you without being asked. That goes on the review file. Under DORA we need more than notice. For the register of information I need the following. First, please provide a dated commitment for the post-incident review. A promise to send it when ready is not something I can show the Central Bank. Second, please state whether any data held for our evaluation was affected, and on what basis you know that. Third, please set out how and when you would notify us of a similar event once we are a customer, in terms of notification times rather than intentions. I do not accept a verbal assurance on any of these, so please put each in writing and attach the evidence. The incident history finding stays open until then. Regards, Declan Furlong, CISO