Home / Incident Response & Forensics
Finding out what actually happened
When something has gone wrong — or when your name appears somewhere it should not — guessing is expensive and denial is not evidence.
Their name appeared on a ransomware leak site. They had not been breached.
A three-location surgical practice in Charlotte County was publicly listed by a ransomware group as one of its victims. Patient data, the group claimed, had been taken.
It was not true. The data belonged to a different surgical center in another part of the state. But a claim like that does not disprove itself, and a medical practice cannot simply say “that was not us” and move on.
It took several weeks of forensic work to establish what had actually happened and clear their name.
What we do
- Establish scope — what was actually accessed, and what was not
- Preserve evidence properly, in case it is needed later
- Contain and remediate
- Produce a written finding you can give to an insurer, a regulator or a client
- Harden what let it happen
Tell us what you're building, or what isn't working.
Call or text us. If it's a project, we'll come look at the space. If it's your network, we'll tell you what we find — including if the answer is that you don't need us yet.