Question

Case File: Crimson Market Data Breach (Page 3)
Security officers at Crimson Market reviewed the building’s surveillance cameras from the night of the attack. Video
footage shows an individual entering the building at approximately 1:52 AM using an employee access card.
The footage shows the individual entering the IT department server room. Although the image quality is poor,
investigators believe the person resembles Daniel Reyes. However, the employee schedule indicates that Daniel
Reyes was not scheduled to work that night.
Within hours of the attack being reported, customers began reporting fraudulent purchases made using their credit
cards. Investigators traced shipments to a warehouse outside the city, suggesting an identity theft operation
connected to the breach.
Digital investigators also traced the cryptocurrency wallet used in the ransom demand and found connections to
other cybercrime activities across multiple states.
Investigator Notes & Evidence Annotation (Back Side)
Directions: Underline crimes, circle evidence, highlight witness statements, and note the specialized unit in the
margin.
Part 1: Identify the Crimes
Primary Crime: ________________________________________________
Crime #2: ______________________________________________________
Crime #3: ______________________________________________________
Part 2: Evidence Collection (List at least 4)
1. ________________________________________________________________
2. ________________________________________________________________
3. ________________________________________________________________
4. ________________________________________________________________
Checks for Understanding
CFU 1: Digital evidence is:
A. Physical B. Testimonial C. Digital D. Circumstantial
CFU 2: Why is the 2:14 AM server log important?
_______________________________________________________________
CFU 3: Why are multiple specialized units needed?
_______________________________________________________________
Case File: Crimson Market Data Breach (Page 4)
One employee reported that Daniel Reyes had been acting unusually stressed for several weeks. The witness stated
that Reyes had received threatening messages online demanding access to company systems.
During questioning, Reyes became visibly distressed and began experiencing a panic attack. Officers paused the
interview and requested assistance from crisis intervention specialists.
Investigators are now trying to determine whether Reyes was a suspect, a victim of coercion, or an innocent
employee whose credentials were compromised by hackers.
Investigator Notes & Evidence Annotation (Back Side)
Directions: Underline crimes, circle evidence, highlight witness statements, and note the specialized unit in the
margin.
Part 1: Identify the Crimes
Primary Crime: ________________________________________________
Crime #2: ______________________________________________________
Crime #3: ______________________________________________________
Part 2: Evidence Collection (List at least 4)
1. ________________________________________________________________
2. ________________________________________________________________
3. ________________________________________________________________
4. ________________________________________________________________
Checks for Understanding
CFU 1: Digital evidence is:
A. Physical B. Testimonial C. Digital D. Circumstantial
CFU 2: Why is the 2:14 AM server log important?
_______________________________________________________________
CFU 3: Why are multiple specialized units needed?
_______________________________________________________________

Answer 1

Case File: Crimson Market Data Breach — Page 3

Part 1: Identify the Crimes
Primary Crime: Computer intrusion / data breach (unauthorized access; ransomware/extortion)
Crime #2: Identity theft / credit card fraud
Crime #3: Money laundering / interstate fraud (use of cryptocurrency and shipments to a warehouse)

Part 2: Evidence Collection (at least 4)
1. Surveillance video showing individual entering with an employee access card
2. Employee access-card swipe logs and employee schedule (showing Daniel Reyes not scheduled)
3. Server logs (including the 2:14 AM log)
4. Cryptocurrency wallet trace and shipping records to the external warehouse
(also: customer fraud complaints/charge records; ransom demand message)

Checks for Understanding
CFU 1: Digital evidence is:
C. Digital

CFU 2: Why is the 2:14 AM server log important?
It provides a timestamped record of activity on the servers at the time of the breach (who/what account accessed which files, commands run, data exfiltration events and source IPs). It can corroborate the surveillance/access-card timeline and show technical indicators of compromise.

CFU 3: Why are multiple specialized units needed?
The incident spans cyber intrusions, financial fraud, and physical security/forensic issues. Cyber/digital forensics, financial crimes/identity-theft units, physical security/surveillance investigators, and legal/prosecutorial specialists are each needed for technical analysis, tracing funds, recovering evidence, and coordinating jurisdictional responses.

––––––––––––––––––––––––––––––––––––––––––––––––––

Case File: Crimson Market Data Breach — Page 4

Part 1: Identify the Crimes
Primary Crime: Extortion / coercion (threatening messages demanding access)
Crime #2: Computer intrusion / unauthorized access (data breach)
Crime #3: Identity theft / credit card fraud (resulting from the breach)

Part 2: Evidence Collection (at least 4)
1. Threatening online messages demanding access to company systems
2. Witness statement: employee reporting Daniel Reyes’ unusual stress after receiving threats
3. Interview notes/recording showing Reyes’ panic attack and involvement of crisis intervention specialists
4. Access logs, server logs, and any indicators tying Reyes’ credentials to the breach (or showing credential compromise)
(also: surveillance footage, employee schedule, digital forensics of the messaging accounts)

Checks for Understanding
CFU 1: Digital evidence is:
C. Digital

CFU 2: Why is the 2:14 AM server log important?
It timestamps server activity during the intrusion and may show the attacker's actions (file access, data transfer), helping to link physical access, credential use, and the timeline of the breach.

CFU 3: Why are multiple specialized units needed?
Because this case involves technical cyber-forensics, criminal financial investigations (identity theft/fraud), victim/witness welfare (crisis intervention and behavioral-health specialists), and physical security forensics. Each unit provides expertise for evidence recovery, tracing funds and shipments, interviewing/victim support, and legal coordination.