Fabricated steel components client
Background
Client X3 ships high-value fabricated steel components under a contract protecting shipment schedules and destination sites. On 15 July 2026, a schedule containing dates, quantities and site addresses was mistakenly included in an email sent to another client’s distribution list.
Detection and containment
- 15 July: a recipient noticed the error within an hour and alerted Cross Roads; the incident was reported internally the same day.
- 16 July: contacted recipients, requested deletion and obtained written confirmation from all four recipients within 24 hours.
- 16 July: transparently informed the client’s account contact of the error, containment steps and outcome.
- 18 July: reviewed and separated distribution lists by client account to prevent cross-client visibility.
Results
Deletion was confirmed by all recipients within 24 hours. There was no evidence of further disclosure or misuse, the relationship continued, and no contract or reputational impact was reported.
Lesson learned
Shared distribution lists create unnecessary exposure. A standing quarterly review of client-facing lists is recommended to verify separation between accounts. The response falls under Confidentiality and Data Protection in the Client Relationship and Service Management Policy. The X3 identifier protects the client’s privacy.
Results
Deletion confirmed by all 4 recipients within 24 hours No evidence of further disclosure or misuse Client relationship maintained