Incident Response and Litigation Support

Kroll is the largest global incident response provider with unrivalled expertise and frontline threat intel to protect, detect and respond against attacks on the digital and physical frontiers.

No matter the type of data loss or cybercrime, Kroll has the experience and resources (human and technology) to move quickly, to discern, isolate and secure valuable relevant data and investigate the digital trail, wherever it may lead. For example, in the case of malicious insiders, we can combine computer forensic expertise with traditional investigative methodology, including interviews and surveillance, to retrace the behavior of people who may have had access to protected or proprietary information.

In the event of digital attacks, such as malware, ransomware or email account compromise, Kroll’s cyber investigation teams can collect and examine physical and digital evidence to uncover important information, such as where, when and how an incident occurred—and if systems are still at risk. We will determine what data was compromised and whether digital evidence was erased or modified. We will also work with your teams to recover data, whenever possible, and recreate events and exchanges so that you have an accurate diagnosis to develop an effective recovery plan.

Digital attacks oftentimes may include a physical component, including infiltration of local offices within an organization or tangible threats to staff, executives and boards. Our cyber team works hand-in-hand with Kroll’s enterprise security risk management experts to ensure that organizations are protected on all fronts following an incident.

Case Study – Insider Threat Investigation

A global software company based in Europe received an email from an anonymous source stating the sender had access to personally identifiable information, confidential financial data and IP source code for one of its subsidiaries. The sender gave Kroll’s client two weeks to pay a ransom of one million euros in bitcoin before it was leaked. Kroll's forensic investigators got to work – ascertaining that the information in question could only have come from an insider threat. Our experts identified the individual responsible – a former employee - and provided the necessary evidence to assist with a prosecution and eventual conviction.

For more details, read the full case study.

Kroll’s cybercrime investigation experts reflect our multidisciplinary team approach to problem-solving and leadership. In the event of litigation or regulatory action, we can work closely with general counsel, senior executives, audit committees or outside counsel at each stage to explicate forensics data and assure your objectives are met. If requested, we can assemble a case file for a referral to a regulator or law enforcement agency or serve as expert witnesses.

Looking for Business Continuity/Disaster Recovery Solutions?

Many more solutions are available, use the links on this page to explore them further or speak to a Kroll expert today via our 24x7 cyber incident hotlines or our contact page.

Key Areas

• Data Collection and Preservation
• Data Recovery and Forensic Analysis
• Malware and Advanced Persistent Threat Detection
• PHI and PII Identification
• Payment Card Industry Services
• Office 365 Security, Forensics and Incident Response
• Strategic Communications
• Incident Response Planning and Development