Question

Case File: Crimson Market Data Breach (Page 1)
At approximately 7:45 AM Monday morning, employees arriving at Crimson Market, a large online retail company,
discovered that the company’s computer systems were not functioning normally. When staff members attempted to
log into their workstations, every computer screen displayed the same message.
"Your system has been compromised. All customer data has been encrypted. Pay 12 Bitcoin within 48 hours or the
data will be released."
The message also included a digital wallet address and instructions on how to transfer the payment using
cryptocurrency. Company executives immediately contacted law enforcement and reported what they believed was
a cyberattack targeting the company’s customer database.
Preliminary internal reports indicate that the company’s servers store thousands of customer credit card numbers,
home addresses, and personal identification data. Investigators quickly realized that if this information had been
stolen, customers could become victims of financial fraud and identity theft.
Investigator Notes & Evidence Annotation (Back Side)
Directions: Underline crimes, circle evidence, highlight witness statements, and note the specialized unit in the
margin.
Part 1: Identify the Crimes
Primary Crime: ________________________________________________
Crime #2: ______________________________________________________
Crime #3: ______________________________________________________
Part 2: Evidence Collection (List at least 4)
1. ________________________________________________________________
2. ________________________________________________________________
3. ________________________________________________________________
4. ________________________________________________________________
Checks for Understanding
CFU 1: Digital evidence is:
A. Physical B. Testimonial C. Digital D. Circumstantial
CFU 2: Why is the 2:14 AM server log important?
_______________________________________________________________
CFU 3: Why are multiple specialized units needed?
_______________________________________________________________
Case File: Crimson Market Data Breach (Page 2)
When investigators from the Cybercrime Task Force arrived at the building, the company’s IT department provided
system access logs. The logs revealed that the company’s secure server had been accessed at 2:14 AM, several
hours before employees arrived for work.
According to the digital access records, the login credentials used to enter the server belonged to an internal
employee account assigned to a network technician named Daniel Reyes.
Further review of the system logs showed that several large files had been downloaded shortly after the login
occurred. The files included customer payment data and account information. Digital forensic specialists were called
to examine the company’s computers and internal network.
During the forensic examination, investigators located malware installed on one of the company’s servers. The
malware appeared to have been specifically designed to capture financial information and transfer the data to an
external location.
Investigator Notes & Evidence Annotation (Back Side)
Directions: Underline crimes, circle evidence, highlight witness statements, and note the specialized unit in the
margin.
Part 1: Identify the Crimes
Primary Crime: ________________________________________________
Crime #2: ______________________________________________________
Crime #3: ______________________________________________________
Part 2: Evidence Collection (List at least 4)
1. ________________________________________________________________
2. ________________________________________________________________
3. ________________________________________________________________
4. ________________________________________________________________
Checks for Understanding
CFU 1: Digital evidence is:
A. Physical B. Testimonial C. Digital D. Circumstantial
CFU 2: Why is the 2:14 AM server log important?
_______________________________________________________________
CFU 3: Why are multiple specialized units needed?
_______________________________________________________________

Answer 1

Case File: Crimson Market Data Breach — Answers

Page 1

Part 1: Identify the Crimes
- Primary Crime: Ransomware/extortion (unauthorized encryption and demand for payment)
- Crime #2: Theft of customer data / data exfiltration (unauthorized access and copying of payment & PII)
- Crime #3: Identity theft / risk of financial fraud (or: computer intrusion / unauthorized access)

Part 2: Evidence Collection (at least 4)
1. Screenshot or saved copy of the ransomware message (including the wallet address and payment instructions)
2. The cryptocurrency wallet address and blockchain transaction records
3. System/server logs showing access times and actions
4. Forensic images of affected workstations/servers (to preserve encrypted files and malware)
(also relevant: employee witness statements about seeing the message; backup logs; network traffic logs showing outbound connections)

Checks for Understanding
CFU 1: Digital evidence is: C. Digital
CFU 2: Why is the 2:14 AM server log important?
- It provides the timestamp for when the breach occurred (establishes timeline), shows which account was used to access the server, and links that access to the subsequent large file downloads — essential for identifying the attacker or compromised account and for preserving/protecting evidence.
CFU 3: Why are multiple specialized units needed?
- Because this incident spans technical forensic work (digital/network forensics, malware analysis), criminal investigation (interviewing, chain-of-custody, prosecutorial work), financial tracing (cryptocurrency/transaction analysis), and victim mitigation (identity-theft unit/customer notification). Each requires different skills, tools, and legal procedures.

Page 2

Part 1: Identify the Crimes
- Primary Crime: Unauthorized access / data exfiltration (server accessed and large files downloaded)
- Crime #2: Malware distribution/use (malware installed to capture financial information)
- Crime #3: Insider misuse or credential compromise (access used an employee account — possible insider action or compromised credentials) — also could be charged as computer intrusion and theft

Part 2: Evidence Collection (at least 4)
1. Server access logs showing the 2:14 AM login and the account used (Daniel Reyes)
2. Logs showing the large file downloads (file names, sizes, timestamps)
3. Malware binary and its forensic analysis/report (hashes, indicators of compromise)
4. Forensic image of the server(s) and Daniel Reyes’s workstation (preserve artifacts, memory, credential caches)
(also relevant: outbound network traffic and destination IPs, logs of data transfers to external hosts, corporate account/credential usage logs, CCTV/physical access logs, email/communications of the employee)

Checks for Understanding
CFU 1: Digital evidence is: C. Digital
CFU 2: Why is the 2:14 AM server log important?
- It marks when unauthorized access began, ties the activity to a specific account (Daniel Reyes), and correlates directly with subsequent data downloads — crucial to establish who accessed the data and when.
CFU 3: Why are multiple specialized units needed?
- Investigating requires digital forensics (to image drives, analyze malware, and preserve logs), network/cyber analysts (to trace exfiltration and C2 infrastructure), financial/crime analysts (to trace payments in cryptocurrency and assess victim impact), and traditional criminal investigators (to pursue insider involvement, interview witnesses, and prepare charges). Each unit provides expertise and legal processes needed to collect, analyze, and secure different types of evidence.

If you’d like, I can:
- Draft a prioritized evidence collection checklist (order of volatility / preservation steps).
- Suggest interview questions for Daniel Reyes and IT staff.
- Outline probable charges and statutes to consider for prosecution.