Data leak
Victim of a data leak? What to do right now
Exfiltrated data, database posted on a forum, compromised account or mailbox: every hour counts to contain the leak, protect the people concerned and preserve the evidence. Here is what to do, then how we step in.
RAID Square is a French digital investigation and cybersecurity firm. After a data leak, we qualify what leaked and through which vector, monitor the spread of the data on the clear and dark web, identify the perpetrators when possible and produce an admissible expert report for your CNIL notification, your complaint and your insurers. More than 500 operations carried out.
The first 5 steps
- 1
Contain without destroying
Isolate the accounts and machines concerned, revoke access and API keys, change passwords. Do not wipe or reinstall anything: logs are your evidence.
- 2
Preserve the evidence
Keep the logs, screenshots of the listing or forum, messages received, addresses and timestamps. Note who did what and when.
- 3
Qualify the leak
Which data, how many people, how sensitive (identity, health, payment, passwords)? This qualification drives your obligations and priorities.
- 4
Notify within the deadlines
Personal data: notify the CNIL within 72 hours and inform the people concerned if the risk is high. Payment data: alert the banks. Inform your cyber insurer.
- 5
File a complaint
File a complaint with the police or online; report on Pharos. Cybermalveillance.gouv.fr guides you. Get legal advice.
How we support you
Technical qualification, monitoring and evidence: we work with what will be judicialised next in mind.
Describe my situationQualifying the leak
Exact scope of the data, compromise vector and root cause, through forensic analysis of logs and systems.
Clear and dark web monitoring
Monitoring of the spread and resale of the data, alerts on new publications, takedown requests where possible.
Identifying the perpetrators
OSINT, cross-referencing and fund tracing to identify the actors and document the chain of responsibility.
Admissible report
An expert report usable for the CNIL notification, the insurer, your lawyer and the courts, with support throughout the proceedings.
Common situations
- Customer database posted on a forum or a Telegram channel
- Exfiltration during a ransomware attack (double extortion)
- Compromised email or cloud account (phishing, credential stuffing)
- Leak through a supplier or a poorly protected API
- Executive's personal data exposed (doxxing)
- Leaked API keys or crypto wallet
Why RAID Square
More than 500 operations
Four years of post-crisis work for companies, victims, banks, insurers and law firms.
Technical expertise for the courts
Regularly called upon in court cases, alongside law firms, courts, liquidators and elite government units.
100% French and self-funded
A self-funded, independent and sovereign company: the confidentiality of your case is a condition, not an option.
Frequently asked questions
- Do I have to notify the CNIL?
- Yes, as soon as personal data is involved and the breach poses a risk to the people concerned: the notification must be made within 72 hours of becoming aware of it. We help you qualify the leak to document that notification.
- Should I pay to prevent publication?
- Not without an assessment. Paying guarantees nothing, funds crime and may expose you legally. We first assess what the perpetrators really hold and how credible they are.
- Can you get the published data taken down?
- Sometimes, depending on the medium (forum, host, search engine). We document the publication, file the takedown requests that are possible and monitor republications.
- Who in the company should contact us?
- The CEO, the CIO or CISO, the DPO or the lawyer in charge: a single point of contact is enough to start the engagement. We then coordinate with your providers, your insurer and your counsel.
Contact
Describe the leak
What you know (data concerned, date, how you found out) and your deadline. Fast answer, confidentiality guaranteed.