Investigation covers the forensic analysis of cyber incidents, helping determine how attacks occurred, what was affected, and which evidence supports response.
Search across headline titles and summaries.
Background for this topic.
Investigation is the systematic examination of an event, claim, or suspected activity to establish what happened, when it happened, and who or what was involved. In information security, it commonly covers suspected intrusions, misuse of accounts, data exposure, fraud, and control failures. Investigators reconstruct an event from sources such as authentication records, endpoint artifacts, network telemetry, cloud logs, and disk or memory images, then determine the affected systems, data, and attack path.
Reliable investigations depend on preserving evidence without altering it, recording its provenance, and separating confirmed facts from assumptions. Findings can guide containment and recovery, reveal vulnerabilities that require remediation, and provide threat intelligence about tools or techniques used against an organization. Privacy and legal requirements may restrict what data can be collected or shared, while weak logging, short retention, or uncontrolled access can leave important questions unanswered and undermine any disciplinary, regulatory, or judicial action.
Law enforcement authorities have allegedly arrested a key member of the notorious cybercrime group called Scattered Spider
All Patients, Employees Offered Credit Monitoring While Investigation ContinuesRansomware attackers stole files that potentially contain patient and employee data from seven of Ascension's 25,000 servers. The hackers gained access to the organization's network when an employee inadvertently downloaded a file containing malware, said the Missouri-based healthcare system.
Cleveland Investigating Cyber Incident that Forced City to Shutdown IT SystemsThe city of Cleveland, Ohio is launching an investigation into an apparent cyber event that forced a shutdown of its information technology systems throughout the start of the week, officials said Tuesday, though additional details surrounding the incident remain unclear.
Perry Johnson & Associates' 2023 Data Theft Breach Affected About 14 MillionThe 2023 hack at medical transcription firm Perry Johnson & Associates, which affected dozens of clients and about 14 million individuals, triggered the largest health data breach reported to regulators last year. Now the incident appears to be under federal criminal investigation.
The two jurisdictions will work together to investigate the credential-stuffing attack that put the personal data of millions at risk.
6.9 Million Individuals' Genetic Details Stolen via 2023 Credential-Stuffing AttackPrivacy regulators in the U.K. and Canada have launched a joint investigation into 23andMe following the direct-to-consumer genetic testing service suffering a massive data breach in October 2023 that led to the theft of 6.9 million individuals' ancestry details.
The ICO and OPC have launched a joint investigation into an October 2023 breach at 23andMe
An investigation into infostealer-driven attacks on Snowflake customers shows that approximately 165 clients potentially had data stolen by financially-motivated hackers, says cyber threat intel firm Mandiant. It attributed the attacks to a cluster of threat activity that it now tracks as UNC5537.
Privacy authorities in Canada and the United Kingdom have launched a joint investigation to assess the scope of sensitive customer information exposed in last year's 23andMe data breach. [...]
Thousands of dodgy SMSes bypassed network filters in UK-first case, it is claimed British police have arrested two individuals following an investigation into an SMS-based phishing campaign using some kind of homebrew hardware.…
Thousands of dodgy SMS messages bypassed network filters in UK-first case, it is claimed British police have arrested two individuals following an investigation into a suspected illegal homebrew phone mast used in SMS-based phishing campaigns.…