My Boss Has Lied To A Client, I Think I Helped, And It's Not Sitting Right With Me.

Recently, my business fell victim to a to a powerful cyber attack that has crippled most of our systems and data repositories. Most of our workstations were compromised and our data has been encrypted and recovery of this data is unlikely. It's been a tough time but we're working through it. On the morning of the attack our IT notified one of our largest clients, whom sends us private data (select employees had to become certified to handle this kind of data to continue business with this client) regularly to our servers via the internet, that we were a victim of a cyber attack. Fast forward a couple days, that client says they will not send files more until they receive an incident report and handle it internally.

First, I do not work in IT and I know very little about the scope of these kinds of cyber attacks. Second, I don't know if our systems can still be accessed by whoever put it on our system or if the malware can be spread.

My boss asked me to write that incident report for them that downplayed the severity of the breach and ultimately did not result in compromised data. I don't actually know if that's true or not and my boss probably doesn't know either. As far as I know, once we use the data they give us for its purpose it is destroyed. My boss changed most of what I originally sent them to downplay it even further. Claiming there was no breach, a server just went down, there was no cyber attack, and out of an abundance of caution the company took the server down, then sent it to the client. My boss is still waiting for their review. I didn't think much of it at the time because I was trying to be helpful in saving a client, but now I think I may have helped my employer make a false claim.

The only documentation of my part is one email with my original report asking if What I wrote works. What is my exposure like?