Ransomware & Data Breach Analysis

What sensitive information did the attacker access or take?

GDF analyzes endpoint, server, identity, cloud and network evidence to determine what the attacker did and which records were affected. We examine evidence of access, file staging, archive creation and transfers alongside the systems and accounts involved. A ransomware event can involve encryption, data theft or both; each conclusion needs supporting evidence.

We identify personally identifiable information (PII) and protected health information (PHI) within the relevant data, then correlate that inventory with the attack timeline. Finding sensitive information in a file establishes its contents, not that an attacker opened or removed it. Our findings distinguish confirmed activity, potentially affected records and questions the available evidence cannot resolve.

Give counsel a defensible scope for reporting

Treating every record in an organization as affected can obscure the actual incident. GDF helps counsel define the relevant data set, remove duplicate records and identify affected information and individuals where the evidence supports it. We document why records are included, excluded or remain uncertain, helping avoid an unnecessarily broad reporting scope without understating exposure.

Notification decisions are not limited to files proven to have been exfiltrated. HIPAA and other applicable requirements can involve unauthorized access, acquisition, use or disclosure. Missing logs do not establish that information was safe. Counsel determines the legal notification obligations using the technical findings and applicable requirements.

Expert findings that support regulatory response

GDF provides clear technical conclusions, supporting evidence, timelines, methods and limitations in a report that counsel can use for regulatory assessments and incident reporting. We work with the legal team to address the questions its reporting process requires and explain where further evidence is needed. A supported conclusion should be stated directly; an unresolved question should not be presented as certainty.