New York Incident Response, Ransomware and Email Compromise
24/7 Incident Response for New York Breaches
Every hour an intruder spends in a New York tenant or network, the audit records that explain the attack move closer to rolling out of retention. Global Digital Forensics answers the 24/7 hotline, preserves those records first and then reconstructs how the attacker got in, what they touched and whether they are still there. You get a timeline that supports notice decisions and a remediation plan your team can execute.
The engagement
Preserve First, Then Reconstruct the Intrusion
Call the 24/7 hotline at (800) 868-8189 or the New York office at (212) 561-5860, and triage starts on that call. Remote preservation of the affected tenants, whether Microsoft 365, Google Workspace, Okta or Entra ID, and of the endpoint detection console begins as soon as authority is confirmed, and examiners go on site in Manhattan, Brooklyn, Queens, the Bronx, Staten Island, Westchester and Long Island for the evidence that has to be collected in person.
Retention is checked in each source on day one. Microsoft Purview Audit at the Standard level generally keeps records for 180 days, qualifying Premium licenses keep certain activity longer and tenant policies change what is actually available, while endpoint, collaboration and provider logs each run on their own clock. We record the license, the policy, the available range and the gaps before anyone relies on a default, because the first question a regulator or an opposing party asks is why a particular record is missing.
The scope answers the questions leadership and the security lead actually have: was there unauthorized access, when did it start, what was accessed, was anything taken, is the actor still inside and what is the safe path to eradication and recovery. The technical timeline is written to feed the notice analysis under the New York SHIELD Act, which requires notice to affected residents within thirty days of discovery, and under NYDFS section 500.17, which gives covered entities seventy two hours from determination. Our ransomware and data breach analysis page describes the national practice behind this work.
If the actor may still be inside, the hotline is the first step, not the scope document. Call (800) 868-8189 and the triage starts on that call.
Scope
Triage and preservation
Identify the authorized cloud, identity and endpoint contacts and the records nearest expiry. Confirm the accessible export paths and the responder availability before remote preservation or endpoint isolation begins, and record who approved each action, what was collected or changed and which periods remain unavailable.
Cloud tenant analysis
Microsoft 365 sign in and audit log analysis, Google Workspace login and admin audit analysis, mailbox rule and delegation review, OAuth application consent grants and inbox forwarding to external addresses, each tied to the account and the time it occurred.
Endpoint and identity
Endpoint detection telemetry from products such as CrowdStrike, SentinelOne and Microsoft Defender for Endpoint, lateral movement analysis, credential theft analysis covering LSASS access, DPAPI and Kerberos ticket activity, and persistence analysis across scheduled tasks, services, registry run keys and WMI event subscriptions.
Ransomware and extortion
Ransomware family identification, encryption scope analysis, decryption feasibility review, exfiltration assessment and technical support for threat actor communications coordinated with counsel. When a specialist negotiator is engaged, GDF supplies the payload analysis and the exfiltration evidence that inform the negotiation.
Business email compromise
Timeline reconstruction from tenant audit logs, identification of the initial access vector, the malicious inbox rules and the OAuth consent grants, review of downstream financial instructions and identification of secondary compromised accounts. The business email compromise page covers this work in depth.
Eradication and recovery support
A written remediation plan naming the control owner, the eradication step, the verification step and the recovery sequence, with hardening recommendations prioritized against what the incident actually exposed rather than against a generic maturity model.
Evidence commonly reviewed
Sources We Pull Before They Roll Off
The incident record is assembled from cloud tenant audit logs, including the Microsoft 365 unified audit log, Entra ID sign in and audit logs and the Google Workspace admin audit, endpoint detection telemetry covering process, network, file and module events, identity provider logs such as the Okta system log, email gateway logs and message tracking, ransomware payloads and threat actor communications, and network flow data and firewall logs where the environment keeps them. Each source is recorded with its retention window and its gaps.
What you receive
What the Board, the CISO and IT Receive
The engagement produces a written technical timeline of the incident, an affected data assessment that feeds the notification analysis, a written remediation plan with a control owner and a verification step for each item, a post incident report suitable for the board committee that receives the CISO's report and, where the matter reaches litigation or regulatory action, a record of the technical work prepared so it can support an expert report.
Not sure which of these logs your tenant still holds? Describe the environment to the New York team and we will tell you which retention clocks are running.
Engagement workflow
Five Workstreams That Run in Parallel
First call triage
The intake identifies the systems, the known indicators, the authority, the existing responders and the urgent retention risks. The written engagement, the responsible contacts and a secure out of band channel are set up on the call, so preservation starts the moment authority is confirmed, with counsel directing privilege and reporting from the outset.
Preservation and containment
Preservation is prioritized against the systems most likely to lose the record: endpoint telemetry windows, Microsoft 365 unified audit logs, cloud audit logs from CloudTrail, Azure Activity and GCP Cloud Audit, authentication logs and any short retention security data. Containment is coordinated with the organization's own IT and security team, and where the environment lacks the capacity to contain, the scope is expanded to cover containment directly with every step and its timestamp captured for the record.
Forensic analysis and reconstruction
The analysis reconstructs the incident along four axes: initial access, execution, lateral movement and exfiltration or impact. Evidence is drawn from endpoint telemetry, host artifacts including event logs, the master file table, the registry, prefetch, the USN journal, jump lists and browser artifacts, memory where it was captured, cloud and authentication logs and network telemetry where available. Findings are written as they are made so the record is durable regardless of who is on the response call at any given hour.
Affected data assessment
Where the incident may have touched personal information, the affected data assessment is prepared as a usable input to the notification analysis under NYDFS section 500.17, the New York SHIELD Act and any applicable federal or state requirement. The assessment separates observed fact, meaning what data was demonstrably accessed or exfiltrated, from inference about what may have been accessible during the incident window. The assessment is written so counsel can make the notice decision against each statutory deadline.
Remediation and closeout
Remediation guidance names the control owner, the verification step and the closeout criteria, and status is tracked to closure. The post incident report carries an executive summary of business impact, a technical narrative a security team can act on, an appendix of indicators of compromise and detection guidance and a lessons learned section that ties observed gaps to specific control improvements. Where the matter later reaches litigation or regulatory action, the record is ready to serve as expert report input.
On a live incident the stages above run in parallel, and preservation never waits for analysis. Our ransomware and data breach analysis page explains the method behind each one.
Frequently asked
Response Speed, Part 500.17, SHIELD Act and Ransom Talks
How fast can you engage on a New York incident?
On the call. The hotline is answered 24/7, triage starts immediately, and remote preservation of cloud tenants and the endpoint console begins as soon as an authorized contact grants access. On site collection is scheduled the same call for evidence that cannot be preserved remotely.
Do you support NYDFS section 500.17 notification analysis?
Yes. Section 500.17 requires a covered entity to notify the superintendent as promptly as possible and no later than seventy two hours after determining that a cybersecurity incident occurred, and an extortion payment carries its own notice within twenty four hours. The technical timeline and affected data assessment are built to support that analysis on that clock.
Do you support New York SHIELD Act analysis?
Yes. The affected data assessment identifies which categories of private information were accessible or accessed. That is the core input to notice under General Business Law section 899-aa, which requires notice to affected New York residents within thirty days after discovery of the breach.
How do you support a ransomware negotiation?
Where the organization engages a specialist negotiator, GDF supplies the technical side: payload analysis, decryption feasibility, proof of exfiltration and the eradication and recovery work that runs alongside the talks.
Can you support litigation that follows an incident?
Yes. The incident record is documented from the first call so that if the matter reaches litigation, arbitration or regulatory action, the technical facts are available in a form that can carry expert testimony. Our examiners have testified in federal and state courts, and the examiner who worked the incident can carry that record into a report or testimony.
Separate What Was Seen From What Was Exposed
Identify the authorized responders, the systems, the time range, the source permissions and the containment steps already taken, then prioritize the records that remain available and record each source's retention and collection status. A row in our incident register shows a successful account sign in, a recorded file export and a missing endpoint period as three separate observations, never one blended conclusion.
The report labels affected data as observed, inferred or undetermined, which is the distinction a regulator and an opposing expert will both press on. Log acquisition, containment, restoration and later verification sit on separate dated rows with their owners, and safe access, secure communication and any on site action are agreed with the operating team while the legal team directs reporting and privilege.
Microsoft Purview audit log retention policies
When the board or a regulator is already asking the affected data question, bring the timeline you have to a free initial consultation and we will show you where observed fact ends and inference begins.
Talk with an examiner
Plan Incident Readiness With the New York Team
For an active incident, call the hotline. For planning, tell us about your tenants, your endpoints and your response team and we will discuss scope in a free, confidential consultation.
Since 1992 · 24/7 dispatch · Court tested experts
Speak with GDF
Call Before the Logs Expire
On the first call a senior responder confirms who can authorize access, identifies the records closest to expiry, starts remote preservation and sets the containment priorities with your team. We set up a secure channel for evidence and credentials.
Our 24/7 hotline is (800) 868-8189.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .