Data breach ransomware demands and establishing the truth

Problem Area

Maintaining control of your own security when another part of your business or part of your supply chain has been attacked.

The Challenge

When part of your organisation or supply has been attacked how do you determine the risk to your business or in the event of receiving a ransomware notification, how do you determine the truth and associated risks without pressing the panic button too soon.

How We Helped

Our customer reached out to us with a request to determine whether they had been attacked, and whether the ransomware demand they had received was legitimate. Using our Incident Response services, we initiated a search of the data that the ransom group had provided, so that we could establish how much of what the client was being told was true, and the associated risk.

Outcome/Benefits

The search discovered that whilst there were files referencing the client, the data was not directly from their servers, but in fact from an associated company dating to 2017 and earlier. We also confirmed that there was nothing of value or concern within the data. The relationship with the associated company had ended in 2017.
We enabled our customer to make an informed decision regarding the payment of the ransom based on what we had identified. The ransom was not paid.