Post Incident Analysis (Data Exfiltration)
KordaMentha supported a client in understanding the full extent of a data breach, working alongside their IT provider to identify the exposure period, method of access and exfiltrated data, and to meet reporting obligations.
Following a data breach that resulted in the exfiltration of sensitive information, the client initially relied on their IT services provider to investigate and report on the incident.
Legal advice prompted the client to seek further clarity on the breach’s scope and impact.
KordaMentha was engaged to provide forensic expertise and a deeper understanding of the exposure period, method of access and nature of the data exfiltrated.
Our team collaborated with the client’s IT provider to retrieve and analyse evidence from system logs, firewall appliances, endpoint backups and other critical infrastructure. The findings enabled the client to understand how the breach occurred, when data was accessed and exfiltrated, and which platforms were used by the threat actor.
How we helped
KordaMentha’s forensic specialists worked closely with the organisation’s IT provider to extract and interpret evidence from multiple sources. Our analysis provided a clear timeline of the breach and identified the systems and data affected.
Using our document review platform, we supported the client in reviewing the exposed data set to identify personally identifiable and confidential information. This enabled the organisation to meet its reporting obligations with confidence.
- Collaborated with IT provider to recover forensic evidence
- Analysed logs, firewall data and endpoint backups
- Identified breach timeline and method of access
- Determined platforms used by threat actor
- Pinpointed accessed and exfiltrated data
- Supported content review of exposed data
- Enabled compliance with reporting requirements
Outcomes acheived
- Clear breach timeline.
- Provided visibility into when and how the breach occurred.
- Identified threat actor’s methods.
- Revealed the platforms and techniques used to access systems.
- Defined scope of data exposure.
- Clarified which data was accessed and exfiltrated.
- Supported regulatory compliance.
- Enabled accurate reporting of affected personal and confidential data.
- Strengthened client understanding.
- Delivered insights beyond initial IT provider findings.
- Enhanced incident response.
- Improved the client’s ability to manage and mitigate future risks.
