The situation
The post appeared on a leak site shortly after business hours on a Friday. It named an international freight forwarder, claimed four terabytes of contracts, customs filings and employee records, and offered a sample archive as proof. A countdown gave the company 72 hours to pay $3.5M in cryptocurrency before everything was published.
The client's incident response team had found no sign of an intrusion, but a clean result after a few hours of log review proves very little. By Saturday morning customers were forwarding screenshots of the post and asking whether their shipping data was safe.
The question
The general counsel asked three things. Is the claim real? If any of it is real, what was taken, and from where? And who are we dealing with? The answers would decide whether to negotiate, what to tell customers and regulators, and how wide the forensic investigation needed to be.
What we did
A lead investigator, two dark web analysts and a data analyst worked the matter through the weekend, with a red-team reviewer assigned from the first hour. We did not contact the crew, did not open a negotiation and did not buy anything.
1. Preserved the claim
The listing, the countdown page, the published file tree of roughly 1.1 million file names and the sample archive of 312 files were captured, timestamped and SHA-256 hashed in Aldervane Capture. Leak sites change without notice, and the first version of a claim is often the most revealing.
2. Dated the samples
None of the 312 sample files had been created or modified after February 2022. The letterhead on the contracts was a design the client had retired that spring. Recent material is the one thing an intruder with live access always has, and it was missing.
3. Matched the samples to an older leak
We compared file names, sizes and hashes against the published index of a data set that had circulated since 2022, when a customs broker the client once used suffered a breach. Of the 312 sample files, 222 matched exactly. The remaining 90 were tariff schedules, brochures and forms that anyone can download from public websites.
4. Measured the claim
The file tree told the same story at scale. Its folder structure followed the broker's document export, not the client's systems. Duplicated folders and public documents had been added to inflate the total. After removing them, about 310 GB of unique material remained, most of it already present in the 2022 index.
5. Profiled the crew
The leak site was five months old and listed 14 earlier victims. For nine of them, the published data matched older leaks. The site's contact handle also appeared on a criminal forum where the same persona had sold recycled credential lists. This was a reseller of old data presenting itself as an intrusion crew.
6. Tried to break it
The red-team reviewer argued the dangerous alternative: a real, recent intrusion, with old files shown first to hold the best material back. If that were true there should be something in the tree that only the client's own systems could have produced. Working with the client's responders, we selected 40 file types that exist nowhere else. None appeared.
| Claim | Test | Result |
|---|---|---|
| 4 TB of stolen data | De-duplication of the published file tree | About 310 GB of unique material |
| Taken from the client's network | Folder structure and file origin | Structure of a former broker's export |
| Current records | Creation and modification dates | Nothing later than February 2022 |
| Fresh, exclusive data | Hash match against a 2022 leak index | 222 of 312 samples already circulating |
| A capable intrusion crew | Review of 14 earlier victim posts | 9 matched to older leaks |
What we found
- High confidence: the sample data originated from the 2022 breach of a third party, not from the client's network.
- High confidence: the four-terabyte figure was inflated with duplicates and public documents.
- Moderate confidence: the crew resells old data and has no demonstrated ability to break into networks.
- Low confidence, reported as a lead: the persona behind the site is the same individual as a credential seller on a second forum.
Open sources cannot prove that a criminal holds nothing else. Our report said so, and said what would change the assessment: any published file dated after February 2022, or any file of a type unique to the client's systems. We watched for both until the countdown expired.
The outcome
The assessment reached the client's crisis team 31 hours after tasking, with 41 hours left on the countdown.
- The client did not negotiate and did not pay.
- Counsel assessed notification duties on the evidence. The personal data in the set had already been the subject of notifications made by the broker in 2022.
- Customers received a factual statement within 48 hours, explaining what the data was and where it came from.
- The forensic investigation was narrowed from a full network review to targeted validation, saving an estimated three weeks of work.
- When the countdown expired, the crew published its archive. It contained nothing our assessment had not described.
What made the difference
The pressure in an extortion case comes from the clock, and the clock pushes people to treat the criminal's description of the data as a fact. We treated it as a claim, and tested it the way we would test any other source. The method is set out in our guide, Verify before you panic.
None of this required buying data or speaking to the crew. A preserved listing, a sample archive and an index of what had leaked before were enough to replace a frightening unknown with a documented answer.