The challenge
In 2025, the client experienced two cyber incidents involving unauthorized access to a customer solutions laboratory and the compromise of artificial intelligence (AI) and high-performance computing (HPC) development systems. The attacks resulted in more than 1TB of data being exfiltrated, accompanied by extortion threats and the potential exposure of sensitive intellectual property.
These incidents created significant legal, regulatory, and commercial risks, requiring an immediate technical and strategic response.
CRA approach
External counsel engaged CRA Forensic Services professionals to lead the technical investigation and support the client’s legal strategy. The team brought deep expertise in cyber incident response within the relevant jurisdiction, along with a strong understanding of regulatory requirements, privilege considerations, and litigation risk.
CRA acted swiftly to coordinate with the client’s technical and legal teams, contain the incidents, isolate affected environments, and terminate threat actor access at an early stage. The team conducted a comprehensive forensic review across complex enterprise systems, including network traffic, orchestration platforms, and code repositories, to determine the scope of the incidents, validate data integrity, and maintain evidential robustness.
CRA’s professionals translated highly technical findings into clear, practical guidance that directly informed legal strategy and decision-making. A critical element of the engagement was the team’s direct management of communications with threat actors. Through careful coordination and strategic negotiation, CRA successfully de-escalated extortion demands and prevented public disclosure, allowing the client and its advisors to retain control of the response.
The engagement team combined senior oversight from a Vice President with experienced forensic principals, creating a lean structure that controlled costs while enabling deep technical analysis, rapid response, and consistent supervision. To accelerate the investigation, CRA leveraged advanced analytics, proprietary scripting, and statistically robust sampling techniques to reduce data review populations without compromising accuracy or defensibility. These methods helped save significant time and minimized disruption to business-critical systems while maintaining forensic integrity.
The impact
Throughout the engagement, CRA demonstrated strong commercial awareness, prioritizing the protection of the client’s proprietary AI and HPC assets while keeping broader business objectives, reputational considerations, and long-term market positioning at the forefront.
As a direct result of CRA’s work, the client avoided extortion payments, restored operational integrity, and strengthened its position for potential litigation and regulatory inquiries. The outcome protected valuable intellectual property, minimized disruption to critical business operations, and helped preserve the company’s competitive advantage.
