Incident Response · 2024
Contained before it hit the headlines
Meridian Retail
<1 hr
Containment
None
Data exfiltrated
3 days
Full recovery
Overview
A ransomware intrusion caught mid-attack, contained, and fully understood before it could reach the client's customer data.
The challenge
The client called at midnight with encrypted file servers spreading fast and no clear picture of how the attacker had got in or how far they had reached.
Our approach
Our response team isolated affected segments within the hour, ran forensics to trace the entry point to a phished VPN credential, eradicated persistence, and rebuilt from known-good backups.
The outcome
Customer data was never reached and operations were restored inside three days. We handed leadership a board-ready account and a hardening plan that closed the door for good.
Keep looking
More engagements
Concerned about something similar?
Every engagement starts with a look at your environment. Let's have that conversation.